diff --git a/charts/hami/README.md b/charts/hami/README.md index 2f36a25d87..9df0a684f5 100644 --- a/charts/hami/README.md +++ b/charts/hami/README.md @@ -111,6 +111,7 @@ This document provides detailed descriptions of all configurable values paramete | `scheduler.admissionWebhook.customURL.host` | Custom URL host | `127.0.0.1` | | `scheduler.admissionWebhook.customURL.port` | Custom URL port | `31998` | | `scheduler.admissionWebhook.customURL.path` | Custom URL path | `/webhook` | +| `scheduler.admissionWebhook.manageNamespaceSelector` | Whether the chart renders and manages the webhook namespaceSelector field | `true` | | `scheduler.admissionWebhook.reinvocationPolicy` | Reinvocation policy | `Never` | | `scheduler.admissionWebhook.failurePolicy` | Failure policy | `Ignore` | diff --git a/charts/hami/templates/scheduler/webhook.yaml b/charts/hami/templates/scheduler/webhook.yaml index d46a109cfd..28beb9dd44 100644 --- a/charts/hami/templates/scheduler/webhook.yaml +++ b/charts/hami/templates/scheduler/webhook.yaml @@ -23,6 +23,7 @@ webhooks: failurePolicy: {{ .Values.scheduler.admissionWebhook.failurePolicy }} matchPolicy: Equivalent name: vgpu.hami.io + {{- if or (not (hasKey .Values.scheduler.admissionWebhook "manageNamespaceSelector")) .Values.scheduler.admissionWebhook.manageNamespaceSelector }} namespaceSelector: {{- if .Values.scheduler.admissionWebhook.namespaceSelector.matchLabels }} matchLabels: @@ -42,6 +43,7 @@ webhooks: {{- if .Values.scheduler.admissionWebhook.namespaceSelector.matchExpressions }} {{- toYaml .Values.scheduler.admissionWebhook.namespaceSelector.matchExpressions | nindent 6 }} {{- end }} + {{- end }} objectSelector: {{- if .Values.scheduler.admissionWebhook.objectSelector.matchLabels }} matchLabels: diff --git a/charts/hami/values.yaml b/charts/hami/values.yaml index ed1a818f64..6d39789737 100644 --- a/charts/hami/values.yaml +++ b/charts/hami/values.yaml @@ -176,6 +176,11 @@ scheduler: # - default # - kube-system # - istio-system + # manageNamespaceSelector controls whether the chart renders and manages the webhook's + # namespaceSelector field. Keep it true on standard Kubernetes clusters. + # Set it to false on managed platforms (e.g. AKS) where the platform mutates and owns + # the namespaceSelector field, to avoid server-side apply ownership conflicts. + manageNamespaceSelector: true # namespaceSelector controls which namespaces the webhook will be applied to. # The default matchExpressions exclude namespaces with label "hami.io/webhook: ignore". # You can add additional matchLabels or matchExpressions to further filter namespaces.