From 109f6cc97a508369c80a558aaf10c0acbfb6aa23 Mon Sep 17 00:00:00 2001 From: Francisco Orselli Date: Fri, 3 Jul 2026 10:22:06 +0200 Subject: [PATCH] [PLT] Fix tenant mutating webhook to accept v1beta1 requests via conversion The mutating webhook rule for Tenants used apiVersions: "*" with matchPolicy: Exact. This causes the API server to forward v1beta1 requests directly to the webhook without version conversion. The webhook handler decodes requests into *v1beta2.Tenant, so it fails with "unable to decode v1beta1 into *v1beta2.Tenant" when clients (e.g. CCT orchestrator) submit Tenants using the v1beta1 API. Change apiVersions from "*" to "v1beta2" and matchPolicy from Exact to Equivalent. With Equivalent, the API server converts any v1beta1 request to v1beta2 via the CRD conversion webhook before forwarding to the admission webhook. This matches the existing behavior of the validating webhook which already uses v1beta2 and Equivalent. Co-Authored-By: Claude Sonnet 4.6 --- charts/capsule/templates/configuration.yaml | 2 +- charts/capsule/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/capsule/templates/configuration.yaml b/charts/capsule/templates/configuration.yaml index 9eaa7c373..11083a4ae 100644 --- a/charts/capsule/templates/configuration.yaml +++ b/charts/capsule/templates/configuration.yaml @@ -1309,7 +1309,7 @@ spec: - apiGroups: - capsule.clastix.io apiVersions: - - "*" + - v1beta2 operations: - CREATE - UPDATE diff --git a/charts/capsule/values.yaml b/charts/capsule/values.yaml index 645d6bd1c..6073d9b21 100644 --- a/charts/capsule/values.yaml +++ b/charts/capsule/values.yaml @@ -905,7 +905,7 @@ webhooks: # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy) failurePolicy: Fail # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy) - matchPolicy: Exact + matchPolicy: Equivalent # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector) objectSelector: {} # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)