fix(helm): fix the namespaceSelector that prevents the webhook from running in the release namespace

[acobaugh]

I noticed my cluster would get wedged any time the gmsa webhook pods weren't running. I've determined the namespaceSelectors for the webhook configurations are not correct.

This PR fixes this, and also allows an additional label to be used on namespaces (windows.k8s.io/disabled: true) to allow the webhooks to be skipped in other namespaces. I just picked that name, but I'm open to using something else. At least in my cluster, there are other namespaces besides kube-system that are critical (karpenter, istio-system, etc) which will never have windows pods in them, but should still be able to function if gmsa is down.

[jsturtevant]

Thanks, this looks like it was indeed a bug in regards to the namespace name. I just ran into this myself on another project. Dropping the link to the comment we found that explained this: kubernetes/kubernetes#92157 (comment).

The other option would be to opt-in to running it on specific namespaces which might be more appropriate?

[acobaugh]

The other option would be to opt-in to running it on specific namespaces which might be more appropriate?

I think I actually like this more, but it will take a bit more work in the chart to make this possible. So basically we'd have a xx/disabled: true OR xx/enabled: true label for namespaces. But, I don't know how other people are using this project. It would make sense that the number of namespaces using gmsa would be less than those that aren't, but I don't know.

Open to ideas here. My priority is at least fixing what's already there ahead of my windows workloads hitting production.

[jsturtevant]

I guess it would be a breaking change to require opt in, but could manage that through the helm option maybe?

Opting out seems like a fine addition and could potentially be used together I think.

[acobaugh]

Yeah, helm value could just default to opt-out, which wouldn't break anyone.

[jsturtevant]

sounds good, could be a follow up PR if you are interested

/lgtm
/assign @marosset

[marosset]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: acobaugh, marosset

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [marosset]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment