Make webhook owner references not a controller (#3255)

We setup namespace as the owner of the webhooks in order to clean up
instances where a user deletes the namespace.

This has issues with ArgoCD which we've included a workaround.
But an upcoming ArgoCD PR will handle owner references properly if
it is not a 'controller=true' reference.

This PR changes the owner reference to not be a controlling one.
We still block owner deletion because that was the original intent
of adding the owner reference.

Author: dprotaso

webhook/configmaps/configmaps.go

@@ -146,6 +146,7 @@ func (ac *reconciler) reconcileValidatingWebhook(ctx context.Context, caCert []b
 			return fmt.Errorf("failed to fetch namespace: %w", err)
 		}
 		nsRef := *metav1.NewControllerRef(ns, corev1.SchemeGroupVersion.WithKind("Namespace"))
+		nsRef.Controller = ptr.Bool(false)
 		webhook.OwnerReferences = []metav1.OwnerReference{nsRef}
 	}
 

webhook/configmaps/table_test.go

@@ -66,6 +66,7 @@ func TestReconcile(t *testing.T) {
 		},
 	}
 	nsRef := *metav1.NewControllerRef(ns, corev1.SchemeGroupVersion.WithKind("Namespace"))
+	nsRef.Controller = ptr.Bool(false)
 	expectedOwnerReferences := []metav1.OwnerReference{nsRef}
 
 	ruleScope := admissionregistrationv1.NamespacedScope

webhook/resourcesemantics/defaulting/defaulting.go

@@ -232,6 +232,7 @@ func (ac *reconciler) reconcileMutatingWebhook(ctx context.Context, caCert []byt
 			return fmt.Errorf("failed to fetch namespace: %w", err)
 		}
 		nsRef := *metav1.NewControllerRef(ns, corev1.SchemeGroupVersion.WithKind("Namespace"))
+		nsRef.Controller = ptr.Bool(false)
 		current.OwnerReferences = []metav1.OwnerReference{nsRef}
 	}
 

webhook/resourcesemantics/defaulting/table_test.go

@@ -67,6 +67,7 @@ func TestReconcile(t *testing.T) {
 		},
 	}
 	nsRef := *metav1.NewControllerRef(ns, corev1.SchemeGroupVersion.WithKind("Namespace"))
+	nsRef.Controller = ptr.Bool(false)
 	expectedOwnerReferences := []metav1.OwnerReference{nsRef}
 
 	// This is the namespace selector setup

webhook/resourcesemantics/validation/reconcile_config.go

@@ -201,6 +201,7 @@ func (ac *reconciler) reconcileValidatingWebhook(ctx context.Context, caCert []b
 			return fmt.Errorf("failed to fetch namespace: %w", err)
 		}
 		nsRef := *metav1.NewControllerRef(ns, corev1.SchemeGroupVersion.WithKind("Namespace"))
+		nsRef.Controller = ptr.Bool(false)
 		current.OwnerReferences = []metav1.OwnerReference{nsRef}
 	}
 

webhook/resourcesemantics/validation/reconcile_config_test.go

@@ -68,6 +68,7 @@ func TestReconcile(t *testing.T) {
 		},
 	}
 	nsRef := *metav1.NewControllerRef(ns, corev1.SchemeGroupVersion.WithKind("Namespace"))
+	nsRef.Controller = ptr.Bool(false)
 	expectedOwnerReferences := []metav1.OwnerReference{nsRef}
 
 	// This is the namespace selector setup