Never let cluster-scoped resources skip webhooks

pkg/apis/admissionregistration/types.go

@@ -195,8 +195,8 @@ type Webhook struct {
 	// NamespaceSelector decides whether to run the webhook on an object based
 	// on whether the namespace for that object matches the selector. If the
 	// object itself is a namespace, the matching is performed on
-	// object.metadata.labels. If the object is other cluster scoped resource,
-	// it is not subjected to the webhook.
+	// object.metadata.labels. If the object is another cluster scoped resource,
+	// it never skips the webhook.
 	//
 	// For example, to run the webhook on any objects whose namespace is not
 	// associated with "runlevel" of "0" or "1";  you will set the selector as

staging/src/k8s.io/api/admissionregistration/v1beta1/types.go

@@ -147,8 +147,8 @@ type Webhook struct {
 	// NamespaceSelector decides whether to run the webhook on an object based
 	// on whether the namespace for that object matches the selector. If the
 	// object itself is a namespace, the matching is performed on
-	// object.metadata.labels. If the object is other cluster scoped resource,
-	// it is not subjected to the webhook.
+	// object.metadata.labels. If the object is another cluster scoped resource,
+	// it never skips the webhook.
 	//
 	// For example, to run the webhook on any objects whose namespace is not
 	// associated with "runlevel" of "0" or "1";  you will set the selector as

staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/namespace/matcher.go

@@ -90,10 +90,10 @@ func (m *Matcher) MatchNamespaceSelector(h *v1beta1.Webhook, attr admission.Attr
 	namespaceName := attr.GetNamespace()
 	if len(namespaceName) == 0 && attr.GetResource().Resource != "namespaces" {
 		// If the request is about a cluster scoped resource, and it is not a
-		// namespace, it is exempted from all webhooks for now.
+		// namespace, it is never exempted.
 		// TODO: figure out a way selective exempt cluster scoped resources.
 		// Also update the comment in types.go
-		return false, nil
+		return true, nil
 	}
 	namespaceLabels, err := m.GetNamespaceLabels(attr)
 	// this means the namespace is not found, for backwards compatibility,

staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/namespace/matcher_test.go

@@ -113,7 +113,7 @@ func TestGetNamespaceLabels(t *testing.T) {
 	}
 }
 
-func TestExemptClusterScopedResource(t *testing.T) {
+func TestNotExemptClusterScopedResource(t *testing.T) {
 	hook := &registrationv1beta1.Webhook{
 		NamespaceSelector: &metav1.LabelSelector{},
 	}
@@ -123,7 +123,7 @@ func TestExemptClusterScopedResource(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if matches {
-		t.Errorf("cluster scoped resources (but not a namespace) should be exempted from all webhooks")
+	if !matches {
+		t.Errorf("cluster scoped resources (but not a namespace) should not be exempted from webhooks")
 	}
 }