Fix: enforce WorkflowRun reference validation

Merged
KR
1mo ago
+65-14

Description of your changes

Fixes #257

This PR makes WorkflowRun reference validation more reliable.

The validating webhook now reads referenced Workflow resources directly from the API server instead of relying on the controller cache. This ensures that admission uses the current state of the referenced workflow.

The Helm chart now applies the configured webhook failure policy from the initial render. With the default Fail policy, a webhook or certificate failure will reject the request instead of silently admitting an invalid WorkflowRun.

The PR also corrects the validating webhook name and preserves the existing CA bundle during upgrades.

How has this code been tested

The tests cover:

  • Rejection of CREATE requests with a missing workflowRef
  • Rejection of UPDATE requests with a missing workflowRef
  • Successful updates using an inline workflow
  • Successful updates referencing a workflow in vela-system

The rendered webhook configuration was also checked to confirm that it uses failurePolicy: Fail and handles CREATE and UPDATE requests for WorkflowRun resources.

Special notes for your reviewer

The existing workflow lookup order is unchanged. A workflow in the WorkflowRun namespace still takes precedence, followed by the shared workflow in vela-system.

Summary by cubic

Enforces WorkflowRun reference validation by reading referenced Workflow resources directly from the API server, and fixes the validating webhook configuration so the failure policy and webhook name are applied correctly.

  • Validation now uses an API reader instead of the controller cache, so admission reflects the current state of the referenced workflow.
  • The Helm chart now renders the configured failurePolicy (default Fail) rather than hardcoding Ignore, and uses the corrected webhook name validating.core.oam.dev.v1alpha1.workflowruns.
  • Upgrades preserve the existing CA bundle from the previously deployed webhook under either the new or legacy webhook name.
  • CREATE and UPDATE requests are rejected when the referenced workflow cannot be resolved; the lookup order (workflow namespace first, then vela-system) is unchanged.