<p>I have a <code>ValidatingAdmissionWebhook</code> with <code>namespaceSelector</code> and <code>objectSelector</code>, in addition to <code>configmap</code>.</p>
<p>Im trying to trigger the ValidatingAdmissionWebhook when the configmap 'UPDATE'.</p>
<p>This is part of the <code>ValidatingAdmissionWebhook</code>:</p>
<pre><code>webhooks:
- name: myWebhook      
  ***
  namespaceSelector:
    matchLabels:
      namespace-label: namespace
  objectSelector:
    matchLabels:
      object-label: object
  rules:
   - operations: ['UPDATE']
     apiGroups: ***
     apiVersion: ***
     resources: ['configmaps']
</code></pre>
<p>This is part of the <code>configmap</code>:</p>
<pre><code>data:
  data1: 'somedata'
metadata:
  name: myConfigmap
  namespace: test
  labels:
    object-label: object
  
</code></pre>
<p>When I remove the <code>namespaceSelector</code> from the ValidatingAdmissionWebhook, it catches the <code>UPDATE</code> from configmap, which is ok.</p>
<p>But I cant figure out how\where to add a namespaceSelector to configmap in order to be caught.</p>
<p>Tried to put it as part of the labels, but with no success:</p>
<pre><code>data:
  data1: 'somedata'
metadata:
  name: myConfigmap
  namespace: test
  labels:
    object-label: object
    namespace-label: namespace   &lt;----
</code></pre>
<p>If the <code>namespaceSelector</code> is a <code>labelSelector</code> kind, im not sure how to use it.</p>
<p>Many thanks.</p>

user1673206
<p>According to the K8s <a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/" rel="nofollow noreferrer">documentation</a>, this is how Namespace Selectors work:</p>
<blockquote>
<p>The namespaceSelector decides whether to run the webhook on a request
for a namespaced resource (or a Namespace object), based on whether
the namespace's labels match the selector.</p>
</blockquote>
<p>For your example to work, make sure to label the namespace your Config Map belongs to with <code>namespace-label: namespace</code></p>
