🐛 (helm/v2-alpha): Expose webhook admission settings by flyzstu · Pull Request #5961 · kubernetes-sigs/kubebuilder

flyzstu · 2026-08-07T04:58:41Z

Summary

Expose webhook namespaceSelector, objectSelector, matchConditions, and timeoutSeconds through Helm values.
Preserve webhook fields already supplied by controller-tools patch markers.
Document the new Helm configuration and regenerate chart fixtures.

Implementation

controller-tools v0.21.0 includes the webhook patch marker support from controller-tools#1339. This change keeps those Kustomize-generated fields authoritative while adding Helm value templates for fields that are not already present in the source webhook configuration.

Validation

make install && make generate
make lint-fix
make lint
make test-unit
make verify-helm
helm template with custom selectors and timeout values

kubernetes-prow · 2026-08-07T04:58:50Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: flyzstu
Once this PR has been reviewed and has the lgtm label, please assign camilamacedo86 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

kubernetes-prow · 2026-08-07T04:58:51Z

Hi @flyzstu. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Copilot

Pull request overview

This PR extends the helm/v2-alpha plugin’s chart generation so admission webhook configuration (namespace/object selectors, CEL matchConditions, and timeoutSeconds) can be driven via Helm values, while attempting to keep any webhook fields already present in the Kustomize/controller-tools output authoritative. It also updates the Helm plugin documentation and regenerates the chart fixtures used in testdata/docs.

Changes:

Add a new Helm templater applier to inject webhook admission settings templates into ValidatingWebhookConfiguration/MutatingWebhookConfiguration manifests.
Extend generated values.yaml with webhook.namespaceSelector, webhook.objectSelector, webhook.matchConditions, and webhook.timeoutSeconds.
Document the new values and update regenerated chart testdata in testdata/ and docs/book/ tutorial fixtures.

Reviewed changes

Copilot reviewed 6 out of 14 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
testdata/project-v4-with-plugins/dist/chart/values.yaml	Adds new `webhook.*` values for selectors, match conditions, and timeout.
testdata/project-v4-with-plugins/dist/chart/templates/webhook/validating-webhook-configuration.yaml	Renders the new webhook admission fields from Helm values.
pkg/plugins/optional/helm/v2alpha/scaffolds/internal/templates/values.go	Updates the `values.yaml` generator to emit the new webhook values.
pkg/plugins/optional/helm/v2alpha/scaffolds/internal/kustomize/templater/templater.go	Invokes the new webhook templating applier for webhook configuration resources.
pkg/plugins/optional/helm/v2alpha/scaffolds/internal/kustomize/templater/templater_test.go	Adds a templater-level test asserting the new values are referenced.
pkg/plugins/optional/helm/v2alpha/scaffolds/internal/kustomize/templater/appliers/webhook.go	New applier that injects templated admission settings into webhook configs.
pkg/plugins/optional/helm/v2alpha/scaffolds/internal/kustomize/templater/appliers/webhook_test.go	New unit test for the webhook applier behavior.
docs/book/src/plugins/available/helm-v2-alpha.md	Documents the new webhook admission configuration values and usage.
docs/book/src/multiversion-tutorial/testdata/project/dist/chart/values.yaml	Regenerated chart values fixture reflecting new webhook values.
docs/book/src/multiversion-tutorial/testdata/project/dist/chart/templates/webhook/validating-webhook-configuration.yaml	Regenerated validating webhook template fixture with new fields.
docs/book/src/multiversion-tutorial/testdata/project/dist/chart/templates/webhook/mutating-webhook-configuration.yaml	Regenerated mutating webhook template fixture with new fields.
docs/book/src/cronjob-tutorial/testdata/project/dist/chart/values.yaml	Regenerated chart values fixture reflecting new webhook values.
docs/book/src/cronjob-tutorial/testdata/project/dist/chart/templates/webhook/validating-webhook-configuration.yaml	Regenerated validating webhook template fixture with new fields.
docs/book/src/cronjob-tutorial/testdata/project/dist/chart/templates/webhook/mutating-webhook-configuration.yaml	Regenerated mutating webhook template fixture with new fields.

flyzstu · 2026-08-07T05:15:49Z

+	var additions strings.Builder
+	if !strings.Contains(yamlContent, "  namespaceSelector:") {
+		additions.WriteString("  {{- with .Values.webhook.namespaceSelector }}\n")
+		additions.WriteString("  namespaceSelector:\n")
+		additions.WriteString("    {{- toYaml . | nindent 4 }}\n")
+		additions.WriteString("  {{- end }}\n")
+	}
+	if !strings.Contains(yamlContent, "  objectSelector:") {
+		additions.WriteString("  {{- with .Values.webhook.objectSelector }}\n")


Fixed in 44e7cc2. TemplateWebhookConfiguration now processes each top-level webhook entry independently instead of using whole-document field checks. A field configured on one webhook no longer suppresses Helm templating for the other entries.

flyzstu · 2026-08-07T05:15:49Z

+	if !strings.Contains(yamlContent, "  timeoutSeconds:") {
+		additions.WriteString("  timeoutSeconds: {{ .Values.webhook.timeoutSeconds }}\n")
+	}


Fixed in 44e7cc2. timeoutSeconds is now rendered inside an optional with block. If the value is removed from values.yaml, the field is omitted and Kubernetes can apply its default instead of receiving an invalid value.

flyzstu · 2026-08-07T05:15:49Z

+import (
+	"strings"
+	"testing"
+)
+
+func TestTemplateWebhookConfiguration(t *testing.T) {


Fixed in 44e7cc2. Replaced the standalone testing.T test with a Ginkgo spec to match the existing appliers test suite style.

flyzstu · 2026-08-07T05:15:49Z

+	configured := `apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+webhooks:
+- name: validation.example.com
+  namespaceSelector:
+    matchLabels:
+      webhook: enabled
+  rules:
+  - apiGroups:
+    - example.com
+`
+	configuredResult := TemplateWebhookConfiguration(configured)
+	if strings.Count(configuredResult, "  namespaceSelector:") != 1 {
+		t.Fatalf("expected an existing namespaceSelector to be preserved without duplication:\n%s", configuredResult)
+	}
+}


Fixed in 44e7cc2. Added a regression case with two webhook entries: one already configured by a patch marker and one unconfigured. The test verifies that the unconfigured entry still receives Helm templates while the existing field is not duplicated.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

camilamacedo86 · 2026-08-07T06:53:35Z

@@ -17,6 +17,21 @@ webhooks:
      path: /mutate-batch-tutorial-kubebuilder-io-v1-cronjob


We need to wait for the release of the new version of controller-tools
Then note that the changes are in the makers and the markers will produce the files with those
We will need to use those on tests and mocks
We will need to update the docs
We will need to test it indeed with e2e tests.
And we will need to check how to expose in the helm.

So, I think we will need to wait here

Lets hold for now and wait the changes be released then we can see how we can do that

/hold

camilamacedo86 · 2026-09-02T15:01:55Z

Hi @flyzstu

We need this one but could you please get the latest changes and rebase it since that will be impacted by.
Also, we need to ensure that we need to do it follow the syntax from controller-tool next release as I described above.

fix(helm/v2-alpha): expose webhook admission settings

8292fa0

Copilot AI lite review requested due to automatic review settings August 7, 2026 04:58

kubernetes-prow Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 7, 2026

kubernetes-prow Bot requested review from camilamacedo86 and varshaprasad96 August 7, 2026 04:58

kubernetes-prow Bot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Aug 7, 2026

kubernetes-prow Bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 7, 2026

kubernetes-prow Bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Aug 7, 2026

Copilot started reviewing on behalf of flyzstu August 7, 2026 04:59 View session

flyzstu marked this pull request as ready for review August 7, 2026 05:00

kubernetes-prow Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 7, 2026

Copilot AI reviewed Aug 7, 2026

View reviewed changes

flyzstu requested a balanced review from Copilot August 7, 2026 05:04

Copilot AI reviewed Aug 7, 2026

fix(helm/v2-alpha): handle webhook values per entry

44e7cc2

Copilot AI review requested due to automatic review settings August 7, 2026 05:15

Copilot AI reviewed Aug 7, 2026

camilamacedo86 reviewed Aug 7, 2026

View reviewed changes

kubernetes-prow Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 8, 2026

kubernetes-prow Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 2, 2026

Navigation Menu

Uh oh!

🐛 (helm/v2-alpha): Expose webhook admission settings - #5961

🐛 (helm/v2-alpha): Expose webhook admission settings#5961
flyzstu wants to merge 2 commits into
kubernetes-sigs:masterfrom
flyzstu:fix/webhook-selectors-5758

flyzstu commented Aug 7, 2026

Uh oh!

kubernetes-prow Bot commented Aug 7, 2026

Uh oh!

kubernetes-prow Bot commented Aug 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

flyzstu Aug 7, 2026

Uh oh!

flyzstu Aug 7, 2026

Uh oh!

flyzstu Aug 7, 2026

Uh oh!

flyzstu Aug 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

camilamacedo86 Aug 7, 2026

Uh oh!

camilamacedo86 Aug 8, 2026

Uh oh!

camilamacedo86 commented Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -17,6 +17,21 @@ webhooks:
		path: /mutate-batch-tutorial-kubebuilder-io-v1-cronjob

Uh oh!

Conversation

flyzstu commented Aug 7, 2026

Summary

Implementation

Validation

Uh oh!

kubernetes-prow Bot commented Aug 7, 2026

Uh oh!

kubernetes-prow Bot commented Aug 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

flyzstu Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

flyzstu Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

flyzstu Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

flyzstu Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

camilamacedo86 Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

camilamacedo86 Aug 8, 2026

Choose a reason for hiding this comment

Uh oh!

camilamacedo86 commented Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants