Adding namespace scope to webhook config

[b3ndill]

This PR explicitly defines the rule scope for the admission-webhook configurations.
Since the rules are only defining one resource type per rule, I chose to explicitly define the scope instead of providing variables that would allow customization.

This fixes #939

Thanks in advance!

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: b3ndill / name: Grétar Hauksson (289d720, e62f42c, effc077, e0f9ba7)

[JaredTan95]

Not sure this change would impact operator's Cross namespace instrumentation feature.
Setting namespaceselector is enough?

[povilasv]

I doublechecked the docs, and this change should be safe.

Based on k8s docs:

scope specifies a scope to match. Valid values are "Cluster", "Namespaced", and "". Subresources match the scope of their parent resource. Default is "".
"Cluster" means that only cluster-scoped resources will match this rule (Namespace API objects are cluster-scoped).
? "Namespaced" means that only namespaced resources will match this rule.
? "*" means that there are no scope restrictions.

Because Operator webhook watches collectors, pods and instrumentations objects which are all namespaced, it should be fine.

[povilasv]

@b3ndill please regenerate examples and commit them:

make generate-examples CHARTS=opentelemetry-operator

[b3ndill]

@povilasv I thought I already had, at least running it on my branch doesn't produce any changes.

[povilasv]

Ah nevermind, CI is failing due to unrelated reason, should be fixed with -> #941

[b3ndill]

@povilasv I've pulled in the latest changes, updated the chart version and the CI is green ;)

[JaredTan95]

Not sure this change would impact operator's Cross namespace instrumentation feature. Setting namespaceselector is enough?

I tested the cross-namespace instrumentation in real-world tests, and it workes well.

tested with yaml:

• apply instrumentation CR in scope-ns-test namespace:

apiVersion: opentelemetry.io/v1alpha1
kind: Instrumentation
metadata:
  name: opentelemetry-autoinstrumentation
  namespace: scope-ns-test
spec:
  resource:
    addK8sUIDAttributes: true
  sampler:
    # Enum: always_on, always_off, traceidratio, parentbased_always_on, parentbased_always_off, parentbased_traceidratio, jaeger_remote, xray
    type: always_on

• apply demo app in default namespae with cross-namespace annotation:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-deployment-with-aotu-instrumentation
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: my-deployment-with-aotu-instrumentation-kuberntes
  replicas: 1
  template:
    metadata:
      labels:
        #app: my-deployment-with-aotu-instrumentation-app
        app.kubernetes.io/name: my-deployment-with-aotu-instrumentation-kuberntes
      annotations:
        #sidecar.opentelemetry.io/inject: "false"
        ##instrumentation.opentelemetry.io/inject-sdk: "default/insight-opentelemetry-autoinstrumentation"
        instrumentation.opentelemetry.io/inject-java: "scope-ns-test/opentelemetry-autoinstrumentation"

    spec:
      serviceAccountName: instrumentation-app
      automountServiceAccountToken: false
      securityContext:
        runAsUser: 1000
        runAsGroup: 3000
        fsGroup: 2000
      containers:
      - name: myapp
        image: ghcr.m.daocloud.io/open-telemetry/opentelemetry-java-instrumentation/smoke-test-spring-boot:jdk11-20211213.1570880324
        #image: docker.m.daocloud.io/library/nginx:1.23.3
        ports:
          - name: http
            containerPort: 8080

and java auto-instrumentation injected in init-container.

So, LGTM

[TylerHelmuth]

LGTM. @dmitryax please also review.

[TylerHelmuth]

@b3ndill I merged another operator PR first, so now we need to bump the patch number again and regenerate the examples. Once you do that I'll make sure this is merged next.

[b3ndill]

@TylerHelmuth Done, thanks for letting me know.