fix: allow webhook calls to fail (#2671)

Author: AlinsRan

config/webhook/manifests.yaml

@@ -11,7 +11,7 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /validate-apisix-apache-org-v2-apisixconsumer
-  failurePolicy: Fail
+  failurePolicy: Ignore
   name: vapisixconsumer-v2.kb.io
   rules:
   - apiGroups:
@@ -31,7 +31,7 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /validate-apisix-apache-org-v2-apisixroute
-  failurePolicy: Fail
+  failurePolicy: Ignore
   name: vapisixroute-v2.kb.io
   rules:
   - apiGroups:
@@ -51,7 +51,7 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /validate-apisix-apache-org-v2-apisixtls
-  failurePolicy: Fail
+  failurePolicy: Ignore
   name: vapisixtls-v2.kb.io
   rules:
   - apiGroups:
@@ -71,7 +71,7 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /validate-apisix-apache-org-v1alpha1-consumer
-  failurePolicy: Fail
+  failurePolicy: Ignore
   name: vconsumer-v1alpha1.kb.io
   rules:
   - apiGroups:
@@ -91,7 +91,7 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /validate-gateway-networking-k8s-io-v1-gateway
-  failurePolicy: Fail
+  failurePolicy: Ignore
   name: vgateway-v1.kb.io
   rules:
   - apiGroups:
@@ -111,7 +111,7 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /validate-apisix-apache-org-v1alpha1-gatewayproxy
-  failurePolicy: Fail
+  failurePolicy: Ignore
   name: vgatewayproxy-v1alpha1.kb.io
   rules:
   - apiGroups:
@@ -131,7 +131,7 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /validate-gateway-networking-k8s-io-v1-grpcroute
-  failurePolicy: Fail
+  failurePolicy: Ignore
   name: vgrpcroute-v1.kb.io
   rules:
   - apiGroups:
@@ -151,7 +151,7 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /validate-gateway-networking-k8s-io-v1-httproute
-  failurePolicy: Fail
+  failurePolicy: Ignore
   name: vhttproute-v1.kb.io
   rules:
   - apiGroups:
@@ -171,7 +171,7 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /validate-networking-k8s-io-v1-ingress
-  failurePolicy: Fail
+  failurePolicy: Ignore
   name: vingress-v1.kb.io
   rules:
   - apiGroups:
@@ -191,7 +191,7 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /validate-networking-k8s-io-v1-ingressclass
-  failurePolicy: Fail
+  failurePolicy: Ignore
   name: vingressclass-v1.kb.io
   rules:
   - apiGroups:
@@ -211,7 +211,7 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /validate-gateway-networking-k8s-io-v1alpha2-tcproute
-  failurePolicy: Fail
+  failurePolicy: Ignore
   name: vtcproute-v1alpha2.kb.io
   rules:
   - apiGroups:
@@ -231,7 +231,7 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /validate-gateway-networking-k8s-io-v1alpha2-udproute
-  failurePolicy: Fail
+  failurePolicy: Ignore
   name: vudproute-v1alpha2.kb.io
   rules:
   - apiGroups:

internal/webhook/v1/apisixconsumer_webhook.go

@@ -42,7 +42,7 @@ func SetupApisixConsumerWebhookWithManager(mgr ctrl.Manager) error {
 		Complete()
 }
 
-// +kubebuilder:webhook:path=/validate-apisix-apache-org-v2-apisixconsumer,mutating=false,failurePolicy=fail,sideEffects=None,groups=apisix.apache.org,resources=apisixconsumers,verbs=create;update,versions=v2,name=vapisixconsumer-v2.kb.io,admissionReviewVersions=v1
+// +kubebuilder:webhook:path=/validate-apisix-apache-org-v2-apisixconsumer,mutating=false,failurePolicy=fail,sideEffects=None,groups=apisix.apache.org,resources=apisixconsumers,verbs=create;update,versions=v2,name=vapisixconsumer-v2.kb.io,admissionReviewVersions=v1,failurePolicy=Ignore
 
 type ApisixConsumerCustomValidator struct {
 	Client  client.Client

internal/webhook/v1/apisixroute_webhook.go

@@ -41,7 +41,7 @@ func SetupApisixRouteWebhookWithManager(mgr ctrl.Manager) error {
 		Complete()
 }
 
-// +kubebuilder:webhook:path=/validate-apisix-apache-org-v2-apisixroute,mutating=false,failurePolicy=fail,sideEffects=None,groups=apisix.apache.org,resources=apisixroutes,verbs=create;update,versions=v2,name=vapisixroute-v2.kb.io,admissionReviewVersions=v1
+// +kubebuilder:webhook:path=/validate-apisix-apache-org-v2-apisixroute,mutating=false,failurePolicy=fail,sideEffects=None,groups=apisix.apache.org,resources=apisixroutes,verbs=create;update,versions=v2,name=vapisixroute-v2.kb.io,admissionReviewVersions=v1,failurePolicy=Ignore
 
 type ApisixRouteCustomValidator struct {
 	Client  client.Client

internal/webhook/v1/apisixtls_webhook.go

@@ -42,7 +42,7 @@ func SetupApisixTlsWebhookWithManager(mgr ctrl.Manager) error {
 		Complete()
 }
 
-// +kubebuilder:webhook:path=/validate-apisix-apache-org-v2-apisixtls,mutating=false,failurePolicy=fail,sideEffects=None,groups=apisix.apache.org,resources=apisixtlses,verbs=create;update,versions=v2,name=vapisixtls-v2.kb.io,admissionReviewVersions=v1
+// +kubebuilder:webhook:path=/validate-apisix-apache-org-v2-apisixtls,mutating=false,failurePolicy=fail,sideEffects=None,groups=apisix.apache.org,resources=apisixtlses,verbs=create;update,versions=v2,name=vapisixtls-v2.kb.io,admissionReviewVersions=v1,failurePolicy=Ignore
 
 type ApisixTlsCustomValidator struct {
 	Client  client.Client

internal/webhook/v1/consumer_webhook.go

@@ -41,7 +41,7 @@ func SetupConsumerWebhookWithManager(mgr ctrl.Manager) error {
 		Complete()
 }
 
-// +kubebuilder:webhook:path=/validate-apisix-apache-org-v1alpha1-consumer,mutating=false,failurePolicy=fail,sideEffects=None,groups=apisix.apache.org,resources=consumers,verbs=create;update,versions=v1alpha1,name=vconsumer-v1alpha1.kb.io,admissionReviewVersions=v1
+// +kubebuilder:webhook:path=/validate-apisix-apache-org-v1alpha1-consumer,mutating=false,failurePolicy=fail,sideEffects=None,groups=apisix.apache.org,resources=consumers,verbs=create;update,versions=v1alpha1,name=vconsumer-v1alpha1.kb.io,admissionReviewVersions=v1,failurePolicy=Ignore
 
 type ConsumerCustomValidator struct {
 	Client  client.Client

internal/webhook/v1/gateway_webhook.go

@@ -49,7 +49,7 @@ func SetupGatewayWebhookWithManager(mgr ctrl.Manager) error {
 
 // NOTE: The 'path' attribute must follow a specific pattern and should not be modified directly here.
 // Modifying the path for an invalid path can cause API server errors; failing to locate the webhook.
-// +kubebuilder:webhook:path=/validate-gateway-networking-k8s-io-v1-gateway,mutating=false,failurePolicy=fail,sideEffects=None,groups=gateway.networking.k8s.io,resources=gateways,verbs=create;update,versions=v1,name=vgateway-v1.kb.io,admissionReviewVersions=v1
+// +kubebuilder:webhook:path=/validate-gateway-networking-k8s-io-v1-gateway,mutating=false,failurePolicy=fail,sideEffects=None,groups=gateway.networking.k8s.io,resources=gateways,verbs=create;update,versions=v1,name=vgateway-v1.kb.io,admissionReviewVersions=v1,failurePolicy=Ignore
 
 // GatewayCustomValidator struct is responsible for validating the Gateway resource
 // when it is created, updated, or deleted.

internal/webhook/v1/gatewayproxy_webhook.go

@@ -42,7 +42,7 @@ func SetupGatewayProxyWebhookWithManager(mgr ctrl.Manager) error {
 		Complete()
 }
 
-// +kubebuilder:webhook:path=/validate-apisix-apache-org-v1alpha1-gatewayproxy,mutating=false,failurePolicy=fail,sideEffects=None,groups=apisix.apache.org,resources=gatewayproxies,verbs=create;update,versions=v1alpha1,name=vgatewayproxy-v1alpha1.kb.io,admissionReviewVersions=v1
+// +kubebuilder:webhook:path=/validate-apisix-apache-org-v1alpha1-gatewayproxy,mutating=false,failurePolicy=fail,sideEffects=None,groups=apisix.apache.org,resources=gatewayproxies,verbs=create;update,versions=v1alpha1,name=vgatewayproxy-v1alpha1.kb.io,admissionReviewVersions=v1,failurePolicy=Ignore
 
 type GatewayProxyCustomValidator struct {
 	Client  client.Client

internal/webhook/v1/grpcroute_webhook.go

@@ -42,7 +42,7 @@ func SetupGRPCRouteWebhookWithManager(mgr ctrl.Manager) error {
 		Complete()
 }
 
-// +kubebuilder:webhook:path=/validate-gateway-networking-k8s-io-v1-grpcroute,mutating=false,failurePolicy=fail,sideEffects=None,groups=gateway.networking.k8s.io,resources=grpcroutes,verbs=create;update,versions=v1,name=vgrpcroute-v1.kb.io,admissionReviewVersions=v1
+// +kubebuilder:webhook:path=/validate-gateway-networking-k8s-io-v1-grpcroute,mutating=false,failurePolicy=fail,sideEffects=None,groups=gateway.networking.k8s.io,resources=grpcroutes,verbs=create;update,versions=v1,name=vgrpcroute-v1.kb.io,admissionReviewVersions=v1,failurePolicy=Ignore
 
 type GRPCRouteCustomValidator struct {
 	Client  client.Client

internal/webhook/v1/httproute_webhook.go

@@ -42,7 +42,7 @@ func SetupHTTPRouteWebhookWithManager(mgr ctrl.Manager) error {
 		Complete()
 }
 
-// +kubebuilder:webhook:path=/validate-gateway-networking-k8s-io-v1-httproute,mutating=false,failurePolicy=fail,sideEffects=None,groups=gateway.networking.k8s.io,resources=httproutes,verbs=create;update,versions=v1,name=vhttproute-v1.kb.io,admissionReviewVersions=v1
+// +kubebuilder:webhook:path=/validate-gateway-networking-k8s-io-v1-httproute,mutating=false,failurePolicy=fail,sideEffects=None,groups=gateway.networking.k8s.io,resources=httproutes,verbs=create;update,versions=v1,name=vhttproute-v1.kb.io,admissionReviewVersions=v1,failurePolicy=Ignore
 
 type HTTPRouteCustomValidator struct {
 	Client  client.Client

internal/webhook/v1/ingress_webhook.go

@@ -44,7 +44,7 @@ func SetupIngressWebhookWithManager(mgr ctrl.Manager) error {
 
 // NOTE: The 'path' attribute must follow a specific pattern and should not be modified directly here.
 // Modifying the path for an invalid path can cause API server errors; failing to locate the webhook.
-// +kubebuilder:webhook:path=/validate-networking-k8s-io-v1-ingress,mutating=false,failurePolicy=fail,sideEffects=None,groups=networking.k8s.io,resources=ingresses,verbs=create;update,versions=v1,name=vingress-v1.kb.io,admissionReviewVersions=v1
+// +kubebuilder:webhook:path=/validate-networking-k8s-io-v1-ingress,mutating=false,failurePolicy=fail,sideEffects=None,groups=networking.k8s.io,resources=ingresses,verbs=create;update,versions=v1,name=vingress-v1.kb.io,admissionReviewVersions=v1,failurePolicy=Ignore
 
 // IngressCustomValidator struct is responsible for validating the Ingress resource
 // when it is created, updated, or deleted.