feat: additionalIgnoredNamespaces at runtime through helm

src/lib/assets/helm.ts

@@ -115,6 +115,10 @@ export function watcherDeployTemplate(buildTimestamp: string): string {
                   {{- toYaml .Values.watcher.env | nindent 12 }}
                   - name: PEPR_WATCH_MODE
                     value: "true"
+                  {{- if .Values.additionalIgnoredNamespaces }}
+                  - name: PEPR_IGNORED_NAMESPACES
+                    value: "{{ join ", " .Values.additionalIgnoredNamespaces }}"
+                  {{- end }}
                 envFrom:
                   {{- toYaml .Values.watcher.envFrom | nindent 12 }}
                 securityContext:
@@ -195,6 +199,10 @@ export function admissionDeployTemplate(buildTimestamp: string): string {
                   {{- toYaml .Values.admission.env | nindent 12 }}
                   - name: PEPR_WATCH_MODE
                     value: "false"
+                  {{- if .Values.additionalIgnoredNamespaces }}
+                  - name: PEPR_IGNORED_NAMESPACES
+                    value: "{{ join ", " .Values.additionalIgnoredNamespaces }}"
+                  {{- end }}
                 envFrom:
                   {{- toYaml .Values.admission.envFrom | nindent 12 }}
                 securityContext:

src/lib/assets/index.ts

@@ -35,20 +35,69 @@ function toYaml(obj: any): string {
   return dumpYaml(obj, { noRefs: true });
 }
 
-function createWebhookYaml(
+// Create a unit test for this function
+export function removeIgnoredNamespacesFromWebhook(
+  webhookConfiguration: kind.MutatingWebhookConfiguration | kind.ValidatingWebhookConfiguration,
+): kind.MutatingWebhookConfiguration | kind.ValidatingWebhookConfiguration {
+  if (
+    webhookConfiguration.webhooks &&
+    webhookConfiguration.webhooks[0] &&
+    webhookConfiguration.webhooks[0].namespaceSelector &&
+    webhookConfiguration.webhooks[0].namespaceSelector.matchExpressions &&
+    webhookConfiguration.webhooks[0].namespaceSelector.matchExpressions[1]
+  ) {
+    webhookConfiguration.webhooks[0].namespaceSelector.matchExpressions[1].values = [];
+  }
+  if (
+    webhookConfiguration.webhooks &&
+    webhookConfiguration.webhooks[0] &&
+    webhookConfiguration.webhooks[0].objectSelector &&
+    webhookConfiguration.webhooks[0].objectSelector.matchExpressions &&
+    webhookConfiguration.webhooks[0].objectSelector.matchExpressions[1]
+  ) {
+    webhookConfiguration.webhooks[0].objectSelector.matchExpressions[1].values = [];
+  }
+  return webhookConfiguration;
+}
+
+// Create a unit test for this function
+export function createWebhookYaml(
   assets: Assets,
   webhookConfiguration: kind.MutatingWebhookConfiguration | kind.ValidatingWebhookConfiguration,
 ): string {
   const yaml = toYaml(webhookConfiguration);
-  return replaceString(
-    replaceString(
-      replaceString(yaml, assets.name, "{{ .Values.uuid }}"),
-      assets.config.onError === "reject" ? "Fail" : "Ignore",
-      "{{ .Values.admission.failurePolicy }}",
-    ),
-    `${assets.config.webhookTimeout}` || "10",
-    "{{ .Values.admission.webhookTimeout }}",
-  );
+  const replacements = [
+    { search: assets.name, replace: "{{ .Values.uuid }}" },
+    {
+      search: assets.config.onError === "reject" ? "Fail" : "Ignore",
+      replace: "{{ .Values.admission.failurePolicy }}",
+    },
+    {
+      search: `${assets.config.webhookTimeout}` || "10",
+      replace: "{{ .Values.admission.webhookTimeout }}",
+    },
+    {
+      search: `
+        - key: kubernetes.io/metadata.name
+          operator: NotIn
+          values:
+            - kube-system
+            - pepr-system
+`,
+      replace: `
+        - key: kubernetes.io/metadata.name
+          operator: NotIn
+          values:
+            - kube-system
+            - pepr-system
+            {{- range .Values.additionalIgnoredNamespaces }}
+            - {{ . }}
+            {{- end }}
+`,
+    },
+  ];
+
+  return replacements.reduce((updatedYaml, { search, replace }) => replaceString(updatedYaml, search, replace), yaml);
 }
 
 function helmLayout(basePath: string, unique: string): Record<string, Record<string, string>> {

src/lib/assets/webhooks.ts

@@ -19,6 +19,7 @@ const peprIgnoreLabel: V1LabelSelectorRequirement = {
   values: ["ignore"],
 };
 
+// Order matters for helm template, kube-system, then pepr-system
 const peprIgnoreNamespaces: string[] = ["kube-system", "pepr-system"];
 
 const validateRule = (binding: Binding, isMutateWebhook: boolean): V1RuleWithOperations | undefined => {

src/lib/assets/yaml.ts

@@ -19,6 +19,7 @@ export async function overridesFile(
   const rbacOverrides = clusterRole(name, capabilities, config.rbacMode, config.rbac).rules;
 
   const overrides = {
+    additionalIgnoredNamespaces: [],
     rbac: rbacOverrides,
     secrets: {
       apiToken: Buffer.from(apiToken).toString("base64"),