Support AllowList/BlockList Mode for Pod Webhook Injection

[0x5457]

Summary

Currently, the Pod Webhook uses whitelist mode: only Pods with tensor-fusion.ai/enabled=true label are injected with TensorFusion.
In some scenarios, users want to enable TensorFusion globally and only exclude specific Namespaces or Pods. The current whitelist approach requires manually adding labels to every Pod, which increases management overhead.

Proposal

Add blacklist mode support with LabelSelector-based exclusion rules for Namespaces and Pods.

Basic example

apiVersion: tensor-fusion.ai/v1
kind: TensorFusionCluster
metadata:
  name: default
spec:
  webhookConfig:
    # Whitelist: current default behavior, only inject pods with tensor-fusion.ai/enabled=true
    # Blacklist: inject all pods except those matching exclusion rules
    injectionMode: Blacklist
    
    exclusionRules:
      # Exact namespace names to exclude
      namespaceNames:
        - kube-system
        - kube-public
        - istio-system
      
      # Namespace LabelSelector
      namespaceSelector:
        matchLabels:
          tensor-fusion.ai/injection: disabled
        matchExpressions:
          - key: environment
            operator: In
            values: [testing, ci]
      
      # Pod LabelSelector
      podSelector:
        matchLabels:
          tensor-fusion.ai/injection: disabled

User Usage

Exclude a Namespace:

apiVersion: v1
kind: Namespace
metadata:
  name: my-namespace
  labels:
    tensor-fusion.ai/injection: disabled

Exclude a Pod:

apiVersion: v1
kind: Pod
metadata:
  labels:
    tensor-fusion.ai/injection: disabled

[Code2Life]

@0x5457 prefer config this in global config rather than TF cluster CR, cuz no way to find which TF cluster name to use when mutating the pod, webhook is global scope, thus config should be global.

Proposed config spec:

dynamicConfig:
  autoMigration:
    // default to false, true means to mutate existing GPU Pod and convert known resource claim ways to TensorFusion way
    enable: true
    scope:
      includes:
        # Exact namespace names to exclude
        namespaceNames:
          - kube-system
          - kube-public
          - istio-system
        
        # Namespace LabelSelector
        namespaceSelector:
          matchLabels:
            tensor-fusion.ai/injection: disabled
          matchExpressions:
            - key: environment
              operator: In
              values: [testing, ci]
        
        # Pod LabelSelector
        podSelector:
          matchLabels:
            business-group: "some team"
      excludes:
        # same

if enable = false, only Pods with tensor-fusion.ai/enabled=true, or contains related resource claim are injected with TensorFusion runtime

if enable = true, includes is empty, excludes is empty, means all Pods that are using GPU will be convert to TensorFusion way and inject TensorFusion runtime

if enable = true, includes is not empty, excludes is empty, means only to include those Pods

if enable = true, includes is empty, excludes is not empty, means default migrate unless match excludes rules

if enable = true, includes is not empty, excludes is not empty, means only to include those Pods, but can not match exclude rules

[Code2Life]

Done by #464