From 1bbc1f1a7d3886f560d76e8f812371b8e745d3a1 Mon Sep 17 00:00:00 2001 From: Mariusz Sabath Date: Wed, 18 Feb 2026 14:46:54 -0500 Subject: [PATCH] fix: CI go-version from go.mod, gate client-registration injection, improve isAlreadyInjected - Use go-version-file instead of hardcoded go-version in CI workflow - Gate client-registration sidecar injection behind EnableClientRegistration flag - Add envoy-proxy and proxy-init container checks to isAlreadyInjected Signed-off-by: Mariusz Sabath --- .github/workflows/ci.yaml | 2 +- .../internal/webhook/injector/pod_mutator.go | 8 ++++++-- .../webhook/v1alpha1/authbridge_webhook.go | 15 ++++++++++++--- 3 files changed, 19 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 880ffe65c..ddd9a00d4 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -15,7 +15,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version: '1.22' + go-version-file: kagenti-webhook/go.mod - name: Lint run: find . -type f -name 'go.mod' -execdir go fmt ./... \; diff --git a/kagenti-webhook/internal/webhook/injector/pod_mutator.go b/kagenti-webhook/internal/webhook/injector/pod_mutator.go index 1ccf0e1ec..58c1b9096 100644 --- a/kagenti-webhook/internal/webhook/injector/pod_mutator.go +++ b/kagenti-webhook/internal/webhook/injector/pod_mutator.go @@ -325,8 +325,12 @@ func (m *PodMutator) InjectSidecarsWithSpireOption(podSpec *corev1.PodSpec, name } // Check and inject client-registration sidecar (with SPIRE option) - if !containerExists(podSpec.Containers, ClientRegistrationContainerName) { - podSpec.Containers = append(podSpec.Containers, m.Builder.BuildClientRegistrationContainerWithSpireOption(crName, namespace, spireEnabled)) + if m.EnableClientRegistration { + if !containerExists(podSpec.Containers, ClientRegistrationContainerName) { + podSpec.Containers = append(podSpec.Containers, m.Builder.BuildClientRegistrationContainerWithSpireOption(crName, namespace, spireEnabled)) + } + } else { + mutatorLog.Info("Skipping client-registration injection (disabled via --enable-client-registration=false)") } // Check and inject envoy-proxy sidecar diff --git a/kagenti-webhook/internal/webhook/v1alpha1/authbridge_webhook.go b/kagenti-webhook/internal/webhook/v1alpha1/authbridge_webhook.go index c0896b31b..83b4e6882 100644 --- a/kagenti-webhook/internal/webhook/v1alpha1/authbridge_webhook.go +++ b/kagenti-webhook/internal/webhook/v1alpha1/authbridge_webhook.go @@ -167,10 +167,19 @@ func (w *AuthBridgeWebhook) Handle(ctx context.Context, req admission.Request) a } func (w *AuthBridgeWebhook) isAlreadyInjected(podSpec *corev1.PodSpec) bool { + // Check sidecar containers (envoy-proxy is always injected by the AuthBridge path, + // so it serves as a reliable marker even when spiffe-helper and client-registration + // are both disabled via their respective flags) for _, container := range podSpec.Containers { - if container.Name == injector.SpiffeHelperContainerName || - container.Name == injector.ClientRegistrationContainerName || - container.Name == injector.EnvoyProxyContainerName { + if container.Name == injector.EnvoyProxyContainerName || + container.Name == injector.SpiffeHelperContainerName || + container.Name == injector.ClientRegistrationContainerName { + return true + } + } + // Also check init containers — proxy-init is always injected by InjectAuthBridge + for _, container := range podSpec.InitContainers { + if container.Name == injector.ProxyInitContainerName { return true } }