Gardener: validate-namespace-deletion webhook is called 2 times

[ialidzhikov]

How to categorize this issue?

/kind question
/priority normal

What happened:
validate-namespace-deletion webhook is called 2 times for single ns delete request.

What you expected to happen:

How to reproduce it (as minimally and precisely as possible):

1. Try to delete a project ns

$ k delete ns $PROJECT_NS

1. Ensure that the validate-namespace-deletion webhook is called 2 times:

time="2020-06-08T18:10:08+03:00" level=info msg="Rejected 'DELETE namespace' request of user 'minikube-user': Direct deletion of namespace \"<PROJECT_NS>\" is not permitted (you must delete the corresponding project \"<PROJECT>\")."
time="2020-06-08T18:10:08+03:00" level=info msg="Rejected 'DELETE namespace' request of user 'minikube-user': Direct deletion of namespace \"<PROJECT_NS>\" is not permitted (you must delete the corresponding project \"<PROJECT>\")."

Anything else we need to know?:

Environment:

• Gardener version: master
• Kubernetes version (use kubectl version):
• Cloud provider or hardware configuration:
• Others:

[ialidzhikov]

Ref https://github.com/kubernetes/kubernetes/issues/91917#issuecomment-640939654

[ialidzhikov]

/close

[timebertt]

I also observed this behaviour for other admission plugins (also for UPDATE calls).
For example, if the ShootValidator denies the request (for example disallows finalizer removal), then it will be immediately invoked again.

It took a quick look and this seems to be done on purpose from the apiserver library, but I am not sure, what is the actual reason for it and if we can/should avoid or reconfigure it.

[ialidzhikov]

I also observed this behaviour for other admission plugins (also for UPDATE calls).
For example, if the ShootValidator denies the request (for example disallows finalizer removal), then it will be immediately invoked again.

It took a quick look and this seems to be done on purpose from the apiserver library, but I am not sure, what is the actual reason for it and if we can/should avoid or reconfigure it.

Generally I observed the same with out ShootValidators and initially started the investigation about them. Then I saw the same happening for validate-namespace-deletion webhook and spend effort on reproducing the issue with it.