From c936df6a062e91052884c75f884b6dce42383404 Mon Sep 17 00:00:00 2001 From: nolancon Date: Thu, 2 Jul 2026 11:01:09 -0400 Subject: [PATCH 1/4] Add flag to disable bucket webhook --- cmd/provider/main.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/cmd/provider/main.go b/cmd/provider/main.go index f1d18793..3b260b0f 100644 --- a/cmd/provider/main.go +++ b/cmd/provider/main.go @@ -337,6 +337,7 @@ func main() { webhookHost = app.Flag("webhook-host", "The host of the webhook server.").Default("0.0.0.0").Envar("WEBHOOK_HOST").String() webhookTLSCertDir = app.Flag("webhook-tls-cert-dir", "The directory of TLS certificate that will be used by the webhook server. There should be tls.crt and tls.key files.").Default("/").Envar("WEBHOOK_TLS_CERT_DIR").String() _ = app.Flag("enable-validation-webhooks", "Enable support for Webhooks. [Deprecated, has no effect]").Default("false").Bool() + disableBucketWebhook = app.Flag("disable-bucket-validation-webhook", "Disable validation webhook for bucket managed resources").Default("false").Bool() enableChangeLogs = app.Flag("enable-changelogs", "Enable support for capturing change logs during reconciliation.").Default("false").Envar("ENABLE_CHANGE_LOGS").Bool() changelogsSocketPath = app.Flag("changelogs-socket-path", "Path for changelogs socket (if enabled)").Default("/var/run/changelogs/changelogs.sock").Envar("CHANGELOGS_SOCKET_PATH").String() // Subresource Client Flags. @@ -478,7 +479,9 @@ func main() { }) kingpin.FatalIfError(err, "Cannot create Kube client") - setupBucketWebhook(mgr, backendStore) + if disableBucketWebhook == nil || !*disableBucketWebhook { + setupBucketWebhook(mgr, backendStore) + } setupProviderConfigControllers( mgr, o, From 9b7a384e51dc9fa7bb8f8033d9ad285c82f6faca Mon Sep 17 00:00:00 2001 From: nolancon Date: Thu, 2 Jul 2026 11:05:43 -0400 Subject: [PATCH 2/4] Update webhook documentation --- docs/WEBHOOKS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/WEBHOOKS.md b/docs/WEBHOOKS.md index 3fb70bfe..d1a5be33 100644 --- a/docs/WEBHOOKS.md +++ b/docs/WEBHOOKS.md @@ -9,7 +9,7 @@ Provider Ceph provides Dynamic Admission Control for Buckets. ### Bucket Validation Webhook Validates Bucket CRs for Create and Update operations. This webhook is also configured with an `objectSelector` label `provider-ceph.crossplane.io/validation-required: true`. -It is the responsibility of the user (or the external system) to ensure that incoming Bucket CRs are given this label to enable webhook validation, should validation for the CR be desired. +It is the responsibility of the user (or the external system) to ensure that incoming Bucket CRs are given this label to enable webhook validation, should validation for the CR be desired. This webhook can be disabled completely by the command line argument `--disable-bucket-validation-webhook` when starting the provider. Create and Update operations on Buckets are blocked by the bucket admission webhook when: - The Bucket contains one or more providers (`bucket.spec.Providers`) that do not exist (i.e. a `ProviderConfig` of the same name does not exist in the k8s cluster). From c984cc9df4a909dd08668bb1a6e2a04f815781fa Mon Sep 17 00:00:00 2001 From: Conor Nolan Date: Thu, 2 Jul 2026 16:15:34 +0100 Subject: [PATCH 3/4] Add env var Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- cmd/provider/main.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cmd/provider/main.go b/cmd/provider/main.go index 3b260b0f..e8d2b008 100644 --- a/cmd/provider/main.go +++ b/cmd/provider/main.go @@ -337,7 +337,7 @@ func main() { webhookHost = app.Flag("webhook-host", "The host of the webhook server.").Default("0.0.0.0").Envar("WEBHOOK_HOST").String() webhookTLSCertDir = app.Flag("webhook-tls-cert-dir", "The directory of TLS certificate that will be used by the webhook server. There should be tls.crt and tls.key files.").Default("/").Envar("WEBHOOK_TLS_CERT_DIR").String() _ = app.Flag("enable-validation-webhooks", "Enable support for Webhooks. [Deprecated, has no effect]").Default("false").Bool() - disableBucketWebhook = app.Flag("disable-bucket-validation-webhook", "Disable validation webhook for bucket managed resources").Default("false").Bool() + disableBucketWebhook = app.Flag("disable-bucket-validation-webhook", "Disable validation webhook for Bucket managed resources").Default("false").Envar("DISABLE_BUCKET_VALIDATION_WEBHOOK").Bool() enableChangeLogs = app.Flag("enable-changelogs", "Enable support for capturing change logs during reconciliation.").Default("false").Envar("ENABLE_CHANGE_LOGS").Bool() changelogsSocketPath = app.Flag("changelogs-socket-path", "Path for changelogs socket (if enabled)").Default("/var/run/changelogs/changelogs.sock").Envar("CHANGELOGS_SOCKET_PATH").String() // Subresource Client Flags. From a9437bb36d64f2e876a8fb0286cce6b45f382b28 Mon Sep 17 00:00:00 2001 From: Conor Nolan Date: Thu, 2 Jul 2026 16:15:59 +0100 Subject: [PATCH 4/4] Remove redundant check Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- cmd/provider/main.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cmd/provider/main.go b/cmd/provider/main.go index e8d2b008..08a34633 100644 --- a/cmd/provider/main.go +++ b/cmd/provider/main.go @@ -479,7 +479,7 @@ func main() { }) kingpin.FatalIfError(err, "Cannot create Kube client") - if disableBucketWebhook == nil || !*disableBucketWebhook { + if !*disableBucketWebhook { setupBucketWebhook(mgr, backendStore) } setupProviderConfigControllers(