From e068a98f4fed7ad1fa92acc00c5d3210acd29675 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Mon, 20 May 2019 17:45:34 -0400 Subject: [PATCH] Skip namespace selector evaluation for 'select all' selectors --- .../admission/plugin/webhook/namespace/matcher.go | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/namespace/matcher.go b/staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/namespace/matcher.go index a0541191539..78dbd528286 100644 --- a/staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/namespace/matcher.go +++ b/staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/namespace/matcher.go @@ -95,6 +95,15 @@ func (m *Matcher) MatchNamespaceSelector(h *v1beta1.Webhook, attr admission.Attr // Also update the comment in types.go return true, nil } + // TODO: adding an LRU cache to cache the translation + selector, err := metav1.LabelSelectorAsSelector(h.NamespaceSelector) + if err != nil { + return false, apierrors.NewInternalError(err) + } + if selector.Empty() { + return true, nil + } + namespaceLabels, err := m.GetNamespaceLabels(attr) // this means the namespace is not found, for backwards compatibility, // return a 404 @@ -108,10 +117,5 @@ func (m *Matcher) MatchNamespaceSelector(h *v1beta1.Webhook, attr admission.Attr if err != nil { return false, apierrors.NewInternalError(err) } - // TODO: adding an LRU cache to cache the translation - selector, err := metav1.LabelSelectorAsSelector(h.NamespaceSelector) - if err != nil { - return false, apierrors.NewInternalError(err) - } return selector.Matches(labels.Set(namespaceLabels)), nil }