From e5c55c3c0dace5df77b9aae31da38892606c1416 Mon Sep 17 00:00:00 2001
From: Manohar Castelino <manohar.r.castelino@intel.com>
Date: Wed, 13 Mar 2019 10:47:46 -0700
Subject: [PATCH] Update webhook setup and documentation

The admission controller is now able to access full context.
Hence explicit tagging of pod manifests to exclude them from
kata is no longer required.

Signed-off-by: Manohar Castelino <manohar.r.castelino@intel.com>
---
 clr-k8s-examples/7-rook/000-operator.yaml     |  2 --
 clr-k8s-examples/7-rook/001-cluster.yaml      |  2 --
 clr-k8s-examples/README.md                    | 25 +++----------------
 .../admit-kata/webhook-registration.yaml      |  4 ---
 4 files changed, 3 insertions(+), 30 deletions(-)

diff --git a/clr-k8s-examples/7-rook/000-operator.yaml b/clr-k8s-examples/7-rook/000-operator.yaml
index ba30f99..c62e67a 100644
--- a/clr-k8s-examples/7-rook/000-operator.yaml
+++ b/clr-k8s-examples/7-rook/000-operator.yaml
@@ -2,8 +2,6 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: rook-ceph-system
-  labels:
-    kata: "false"
 ---
 apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
diff --git a/clr-k8s-examples/7-rook/001-cluster.yaml b/clr-k8s-examples/7-rook/001-cluster.yaml
index 2e237c1..33c012b 100644
--- a/clr-k8s-examples/7-rook/001-cluster.yaml
+++ b/clr-k8s-examples/7-rook/001-cluster.yaml
@@ -2,8 +2,6 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: rook-ceph
-  labels:
-    kata: "false"
 ---
 apiVersion: v1
 kind: ServiceAccount
diff --git a/clr-k8s-examples/README.md b/clr-k8s-examples/README.md
index 4bcb692..7b175e6 100644
--- a/clr-k8s-examples/README.md
+++ b/clr-k8s-examples/README.md
@@ -102,30 +102,11 @@ and sample admission controller we created by running -
 `kubectl apply -f admit-kata/`
 
 The [admission webhook](admit-kata/webhook-registration.yaml)
-is setup to exclude certian namespaces from being run with Kata using filters on namespace labels.
 
-```yaml
-    namespaceSelector:
-      matchExpressions:
-        -  {key: "kata", operator: NotIn, values: ["false"]}
-```
+The webhook mutates pods to use the kata runtime class for all pods except those with
 
-The rook operators for example are marked as such
-
-```yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: rook-ceph-system
-  labels:
-    kata: "false"
-```
-
-Pods not explicitly excluded by the namespace filter are dynamically tagged to
-run with Kata with some [exceptions](https://github.com/mcastelino/kubewebhook/blob/topic/hack-kata/examples/pod-annotate/main.go#L25) -
-
-* `hostNetwork: true`
-* `rook-ceph` and `rook-ceph-system` namespaces (buggy)
+- hostNetwork: true
+- namespace: rook-ceph and rook-ceph-system
 
 Other pod properties will be added as exceptions in future.
 
diff --git a/clr-k8s-examples/admit-kata/webhook-registration.yaml b/clr-k8s-examples/admit-kata/webhook-registration.yaml
index 2c9dd8f..3d44f82 100644
--- a/clr-k8s-examples/admit-kata/webhook-registration.yaml
+++ b/clr-k8s-examples/admit-kata/webhook-registration.yaml
@@ -18,7 +18,3 @@ webhooks:
         apiGroups: [""]
         apiVersions: ["v1"]
         resources: ["pods"]
-    namespaceSelector:
-      matchExpressions:
-        -  {key: "kata", operator: NotIn, values: ["false"]}
-