Skip to content

[Feature] Align the rules of ResourceFilter with those of ValidatingWebhookConfiguration.

Problem Statement

Based on my experience using Kyverno, it requires me to define resource filters to exclude resources that don't need authentication.

However, ResourceFilter, being an internal Kyverno configuration, doesn't affect the apiserver's behavior.

What I mean is, no matter how many exclusion rules we define in ResourceFilter, if it doesn't correspond to a ValidatingWebhookConfiguration, the apiserver will still send requests to Kyverno. This not only wastes more resources on the apiserver but could also lead to serious stability risks.

So, has Kyverno considered converting ResourceFilter rules into equivalent ValidatingWebhookConfiguration rules?

Solution Description

Align the rules of ResourceFilter with those of ValidatingWebhookConfiguration.

Alternatives

No response

Additional Context

No response

Slack discussion

No response

Research

  • I have read and followed the documentation AND the troubleshooting guide.
  • I have searched other issues in this repository and mine is not recorded.