not muttating pods

[ichasco-heytrade]

Hi, I have deployed the webhook but it doesn't mutate any pod

This is the config:

  replicaCount: 1
  image:
    pullPolicy: IfNotPresent
    tag: "main"
  imagePullSecrets: []
  nameOverride: harbor-container-webhook
  fullnameOverride: harbor-container-webhook
  serviceAccount:
    create: true
    annotations: {}
    name: ""
  podAnnotations:
    fluentbit.io/exclude: "true"
  podSecurityContext: {}
  securityContext:
    capabilities:
      drop:
      - ALL
    readOnlyRootFilesystem: true
    runAsNonRoot: true
    runAsUser: 65532
  service:
    type: ClusterIP
    port: 9443
  additionalVolumeMounts: []
  additionalVolumes: []
  initContainers: []
  resources: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}
  extraArgs: []
  extraEnv: []
  priorityClassName: ""
  certManager:
    enabled: true
    apiVersion: "cert-manager.io/v1"
    duration: 2160h0m0s
    renewBefore: 360h0m0s
  webhook:
    namespaceSelector:
      matchExpressions:
        - key: "goharbor.io/harbor-container-webhook-disable"
          operator: NotIn
          values: ["true"]
    objectSelector:
      matchExpressions:
        - key: "goharbor.io/harbor-container-webhook-disable"
          operator: NotIn
          values: ["true"]
    failurePolicy: Ignore
  rules:
    - name: 'docker.io rewrite rule'
      matches:
        - '^docker.io'
      excludes:
        - '.*goharbor.*'
        - '.*auto.*'
      replace: 'harbor.xxxxxx.com/docker-hub-cache'
      checkUpstream: true
  extraRules: []
  certDir: ""
  prometheus:
    enabled: true
    port: 8080
  healthPort: 8090
  verbose: true
  metrics:
    serviceMonitor:
      enabled: false
      jobLabel: ""
      interval: ""
      scrapeTimeout: ""
      honorLabels: false
      metricRelabelings: []
      relabelings: []
      labels: {}
      scheme: http

There isn't any error log :(

+ harbor-container-webhook-846dbb7ccb-pwhhz › harbor-container-webhook
harbor-container-webhook-846dbb7ccb-pwhhz harbor-container-webhook 2025-01-30T09:06:24Z	INFO	setup	webhook namespace: harbor
harbor-container-webhook-846dbb7ccb-pwhhz harbor-container-webhook 2025-01-30T09:06:24Z	INFO	setup	kube client configured for 5.000000.2 QPS, 10 Burst
harbor-container-webhook-846dbb7ccb-pwhhz harbor-container-webhook 2025-01-30T09:06:24Z	INFO	controller-runtime.webhook	Registering webhook	{"path": "/webhook-v1-pod"}
harbor-container-webhook-846dbb7ccb-pwhhz harbor-container-webhook 2025-01-30T09:06:24Z	INFO	setup	starting harbor-container-webhook
harbor-container-webhook-846dbb7ccb-pwhhz harbor-container-webhook 2025-01-30T09:06:24Z	INFO	controller-runtime.metrics	Starting metrics server
harbor-container-webhook-846dbb7ccb-pwhhz harbor-container-webhook 2025-01-30T09:06:24Z	INFO	starting server	{"name": "health probe", "addr": "[::]:8090"}
harbor-container-webhook-846dbb7ccb-pwhhz harbor-container-webhook 2025-01-30T09:06:24Z	INFO	controller-runtime.metrics	Serving metrics server	{"bindAddress": ":8080", "secure": false}
harbor-container-webhook-846dbb7ccb-pwhhz harbor-container-webhook 2025-01-30T09:06:24Z	INFO	controller-runtime.webhook	Starting webhook server
harbor-container-webhook-846dbb7ccb-pwhhz harbor-container-webhook 2025-01-30T09:06:24Z	INFO	controller-runtime.certwatcher	Updated current TLS certificate
harbor-container-webhook-846dbb7ccb-pwhhz harbor-container-webhook 2025-01-30T09:06:24Z	INFO	controller-runtime.webhook	Serving webhook server	{"host": "", "port": 9443}
harbor-container-webhook-846dbb7ccb-pwhhz harbor-container-webhook 2025-01-30T09:06:24Z	INFO	controller-runtime.certwatcher	Starting certificate poll+watcher	{"interval": "10s"}

Everything looks fine

[sevcikh]

Try setting failurePolicy: Fail to see what the error is when applyng a pod you expect a rewrite to the image.

[rdxmb]

As I understood, those mutating webhooks only apply for new or changed objects (e.g. through kubectl apply) .

Existing manifests without apply-changes will not be changed in the cluster