aws / aws/amazon-vpc-resource-controller-k8s

Explore option to make webhook fail open rather than fail close

Open
#602 0 comments 0 reactions 0 assignees View on GitHub
enhancement need investigation
Dominant language
Go
Stars
106
Forks
71
Avg merge
10h 28m
Merged PRs (30d)
6

Description

This can be made configurable or kept as fail close.

**What would you like to be enhanced**:

**Why is the change needed and what use case will it solve**:
In the event of controller being restarted, webhook will be unavailable, If pod is deployed during that time. Webhook will fail open causing pod to schedule with generic ENI rather than branch ENI and security group.

Contributor guide

Open the contributing guide

Research direction

Start by locating the webhook implementation and the controller restart or pod admission path. Determine how webhook unavailability is handled during a controller restart and clarify whether the desired behavior is configurable or should remain fail-closed. Done means the chosen behavior and its security implications are documented and covered by appropriate tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
networking
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.