Is your feature request related to a problem? Please describe.
The .WithName/.WithNameRegex docs don't mention that on mutating bindings these filters won't match CREATE requests that use metadata.generateName, because the name isn't assigned until after mutating admission. Validating bindings are unaffected (they see the resolved name).
Describe the solution you'd like
- Given a user reading the .WithName/.WithNameRegex documentation
- When they scope a binding by name/regex
- Then the docs clearly state (a) these filters don't apply to generateName CREATEs on mutating bindings, and (b) security enforcement should be implemented via validating bindings, per the Kubernetes admission docs
Additional context
Originated from a responsibly-disclosed report by @EchoSkorJjj. Pairs with the fail-loud warning in #3217
Is your feature request related to a problem? Please describe.
The .WithName/.WithNameRegex docs don't mention that on mutating bindings these filters won't match CREATE requests that use metadata.generateName, because the name isn't assigned until after mutating admission. Validating bindings are unaffected (they see the resolved name).
Describe the solution you'd like
Additional context
Originated from a responsibly-disclosed report by @EchoSkorJjj. Pairs with the fail-loud warning in #3217