Agent finalizer does not remove admission webhook config

[chris-pinola-rf]

Consider a DatadogAgent CRD with the following configuration:

apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
spec:
  features:
    admissionController:
      enabled: true
      failurePolicy: Fail
# ...

This resource will result in the creation of a "datadog-webhook" mutatingwebhookconfigurations.admissionregistration.k8s.io resource. When that webhook call fails, new Pod resources are prevented from being created because the webhook has been configured to fail-closed (failurePolicy: Fail). Normally this is a great way to ensure that new workloads have the APM agent injected as expected. However, when a DatadogAgent resource is deleted, it leaves behind the webhook configs but removes the cluster agent pods that typically handle those webhooks, thereby preventing all new Pods from being created until the "datadog-webhook" config resource is manually removed.

Now that the Cluster Agent is authorized (#1591) to delete the "datadog-webhook" mutatingwebhookconfigurations.admissionregistration.k8s.io and validatingwebhookconfigurations.admissionregistration.k8s.io resources, I believe it ought to be possible to have the Operator automatically clean up the webhook configs.

This bug affects the latest stable release of the Operator at the time of writing: v1.15.1 (via Operator Helm chart v2.10.0).

[dd-octo-sts]

This issue has been automatically marked as stale because it has not had activity in the past 15 days.

It will be closed in 30 days if no further activity occurs. If this issue is still relevant, adding a comment will keep it open. Also, you can always reopen the issue if you missed the window.

Thank you for your contributions!

[chris-pinola-rf]

not stale

[chouetz]

Hi @chris-pinola-rf,

Thank you for taking the time to share your feedback. We recently introduced a system to help manage long-standing issues through automated stale management. We understand this may have come as a surprise for some existing issues. We want to apologize if it felt that way. It was not our intent, and we want to reassure you that every issue is important to us and reviewed carefully. For your specific issue, we’re reviewing it to ensure the discussion progresses and receives the right level of attention. Thank you for helping improve the Datadog Agent.

— The Datadog Agent Team