#7042 fix(webhook): replace invalid namespaced owner reference with labels Pull request opened by themavik Summary • Replace invalid namespaced

OwnerReferences

on the cluster-scoped

MutatingWebhookConfiguration

with labels for pod identification Problem The

flyte-pod-webhook

initialization copies the pod's

OwnerReferences

onto the

MutatingWebhookConfiguration

object. Since

MutatingWebhookConfiguration

is cluster-scoped and the pod is namespaced, this violates Kubernetes rules:

Cluster-scoped dependents can only specify cluster-scoped owners. In v1.20+, if a cluster-scoped dependent specifies a namespaced kind as an owner, it is treated as having an unresolvable owner reference, and is not able to be garbage collected.

Ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/owners-dependents/#owner-references-in-object-specifications This means the webhook configuration is never garbage collected on uninstall, leaving orphaned resources. Fix Replace the

OwnerReferences

copy with labels: •

<http://app.kubernetes.io/managed-by|app.kubernetes.io/managed-by>: flyte-pod-webhook

•

<http://flyte.org/webhook-pod-name|flyte.org/webhook-pod-name>: <pod-name>

•

<http://flyte.org/webhook-pod-namespace|flyte.org/webhook-pod-namespace>: <pod-namespace>

This preserves the tracking/identification capability without violating the cluster-scoped/namespaced boundary. The pod lookup (which was only needed to get OwnerReferences) is removed, simplifying the initialization path. Testing • Verified the

MutatingWebhookConfiguration

no longer receives invalid

OwnerReferences

• Labels are set correctly when

POD_NAME

and

POD_NAMESPACE

env vars are present • When env vars are absent, behavior is unchanged (no labels added) Closes #6692 flyteorg/flyte