Unable to patch the namespace not managed by Capsule

[sagar-jadhav]

Bug description

As a capsule user, I am unable to patch the namespace not managed by capsule, even though I have explicit access to patch that namespace.

How to reproduce

Steps to reproduce the behavior:

1. Create a namespace called oil-sj as a cluster admin
2. Follow the https://capsule.clastix.io/docs/general/getting-started/ tutorial
3. As an cluster admin create the following ClusterRole and ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: alice-ns-provisioner
rules:
- apiGroups:
  - ""
  resources:
  - namespaces
  resourceNames:
  - oil-sj
  verbs:
  - create
  - patch
  - get

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: alice-ns-provisioner
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: alice-ns-provisioner
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: alice

4. Login to cluster using alice kubeconfig and run the kubectl annotate ns oil-sj env=stg command. Command fails with below error

Error from server: admission webhook "owner.namespace.capsule.clastix.io" denied the request: the OwnerReference cannot be removed

Expected behavior

As a capsule user I should be able to patch the namespace not managed by capsule, If I have explicit access to patch that namespace.

Logs

N/A

Additional context

• Helm Chart version: capsule-0.3.1

[prometherion]

Planning to release this for v0.3.1, let's wait some days so I can work also on #732.

[sagar-jadhav]

Planning to release this for v0.3.1, let's wait some days so I can work also on #732.

Sure. Thanks