set validationwebhookconfig as Fail close by default for remote clust…

…ers (istio#28389) * set validationwebhookconfig as fail-close by default in remote cluster * refine code comments
sel · Nov 4, 2020 · 33bc956 · 33bc956
1 parent 4796334
commit 33bc956
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/pkg/webhooks/validation/controller/controller.go b/pkg/webhooks/validation/controller/controller.go
@@ -364,6 +364,10 @@ func (c *Controller) reconcileRequest(req *reconcileRequest) error {
 }
 
 func (c *Controller) readyForFailClose() bool {
+	//no synchronization issues for remote cluster, set as fail-close by default
+	if c.o.RemoteWebhookConfig {
+		return true
+	}
 	if !c.dryRunOfInvalidConfigRejected {
 		if rejected, reason := c.isDryRunOfInvalidConfigRejected(); !rejected {
 			scope.Infof("Not ready to switch validation to fail-closed: %v", reason)