CR fixes

Signed-off-by: gshaibi <gshaibi@nvidia.com>

Author: gshaibi

cmd/admission/app/app.go

@@ -167,11 +167,7 @@ func (app *App) Run() error {
 		return err
 	}
 
-	// Separate endpoint, not an addition to the pod validator above: the rules
-	// are disjoint (this one matches only the pods/resize subresource, so no
-	// request is ever validated twice) and the failure policies differ (resize
-	// is fail-open Ignore, pod validation is Fail). The canonical
-	// /validate--v1-pod path is taken, hence the custom path.
+	// Add a new webhook for the resize subresource with Ignore failPolicy
 	if err = ctrl.NewWebhookManagedBy(app.manager, &corev1.Pod{}).
 		WithValidator(admissionhooks.NewPodResizeValidator(
 			app.manager.GetClient(),

cmd/admission/app/options.go

@@ -103,16 +103,13 @@ func InitOptions() *Options {
 			constants.DefaultRuntimeClassName))
 	fs.BoolVar(&options.ValidatePodResizeQuota,
 		"validate-pod-resize-quota", true,
-		"Enable hierarchical queue limit and quota checks on pods/resize requests. "+
-			"Checks are best-effort (fail-open): a resize is admitted rather than blocked when "+
-			"the webhook or its queue and podgroup lookups are unavailable. "+
-			"When false, the webhook admits all resizes without checking queue limits or quota, "+
-			"and --block-upsize-on-bounded-queues is ignored.")
+		"Enable queue limit/quota checks on pod resize requests. "+
+			"Best-effort: if lookups fail, resize is admitted. "+
+			"Ignored if false, disables --block-upsize-on-bounded-queues.")
 	fs.BoolVar(&options.BlockUpsizeOnBoundedQueues,
 		"block-upsize-on-bounded-queues", false,
-		"Reject any upsize on a queue (or ancestor) with a finite CPU or memory limit, "+
-			"regardless of current allocation. Prevents concurrent-resize races from exceeding hard limits. "+
-			"Has no effect when --validate-pod-resize-quota is false.")
+		"Block pod upsize if queue or ancestor has a CPU/memory limit. "+
+			"No effect if --validate-pod-resize-quota is false.")
 
 	utilfeature.DefaultMutableFeatureGate.AddFlag(fs)
 

pkg/operator/operands/admission/admission_test.go

@@ -83,8 +83,8 @@ var _ = Describe("Admission", func() {
 				Expect(mutatingWebhook.Webhooks).To(HaveLen(1))
 				Expect(mutatingWebhook.Webhooks[0].ClientConfig.CABundle).To(Equal(secret.Data[certKey]))
 
-				// failurePolicy per webhook: pods=Fail, topology=Fail, pods/resize=Ignore
-				// (fail-open: the apiserver admits the request if the webhook call fails).
+				// One webhook for pods, one for the Topology one-to-one alias validation,
+				// and one for the pods/resize validation.
 				Expect(validatingWebhook.Webhooks).To(HaveLen(3))
 				for _, wh := range validatingWebhook.Webhooks {
 					Expect(wh.ClientConfig.CABundle).To(Equal(secret.Data[certKey]))

pkg/operator/operands/admission/resources.go

@@ -319,8 +319,6 @@ func (a *Admission) validatingWCForKAIConfig(
 			},
 		},
 		{
-			// pods/resize is best-effort: failurePolicy=Ignore so webhook unavailability
-			// never blocks a legitimate in-place pod resize.
 			Name:                    fmt.Sprintf("podresize.%s", webhookName),
 			AdmissionReviewVersions: []string{"v1"},
 			SideEffects:             common.PtrFrom(admissionv1.SideEffectClassNone),