Repository: knative/pkg
Pull request #2154 (2021-06-11 01:46:47)

[main] Upgrade to latest dependencies
Cron -knative-prow-robot

/cc knative/serving-writers knative/eventing-writers
/assign knative/serving-writers knative/eventing-writers

Produced by: knative-sandbox/knobots/actions/update-deps

Details:
```
bumping knative.dev/hack e35bcb8...3d4b264:
  > 3d4b264 Cleanup release script more (# 74)
  > daccc2c Allow for ignoring arbitrary files with shellcheck (# 48)
```

knative-prow-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/pkg/pull/2154#" title="Author self-approved">knative-automation</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **tcnghia** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @tcnghia` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fpkg).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/knative/pkg/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["tcnghia"]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative/pkg/pull/2154?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) Report
> Merging [#2154](https://codecov.io/gh/knative/pkg/pull/2154?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) (ef1514f) into [main](https://codecov.io/gh/knative/pkg/commit/c96c7beb09df01b2e49a4a84f036bd565656136d?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) (c96c7be) will **not change** coverage.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/knative/pkg/pull/2154/graphs/tree.svg?width=650&height=150&src=pr&token=rlqpDnfxbO&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative)](https://codecov.io/gh/knative/pkg/pull/2154?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative)

```diff
@@           Coverage Diff           @@
##             main    #2154   +/-   ##
=======================================
  Coverage   65.92%   65.92%           
=======================================
  Files         221      221           
  Lines        9351     9351           
=======================================
  Hits         6165     6165           
  Misses       2911     2911           
  Partials      275      275           
```



------

[Continue to review full report at Codecov](https://codecov.io/gh/knative/pkg/pull/2154?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/knative/pkg/pull/2154?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative). Last update [c96c7be...ef1514f](https://codecov.io/gh/knative/pkg/pull/2154?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).


Patch:
diff --git a/go.mod b/go.mod
index a58c1bf25..7e77973a0 100644
--- a/go.mod
+++ b/go.mod
@@ -64,6 +64,6 @@ require (
 	k8s.io/code-generator v0.20.7
 	k8s.io/gengo v0.0.0-20210203185629-de9496dff47b
 	k8s.io/klog v1.0.0
-	knative.dev/hack v0.0.0-20210609124042-e35bcb8f21ec
+	knative.dev/hack v0.0.0-20210610231243-3d4b264d9472
 	sigs.k8s.io/yaml v1.2.0
 )
diff --git a/go.sum b/go.sum
index 5cf794a25..bf7a64c66 100644
--- a/go.sum
+++ b/go.sum
@@ -1063,8 +1063,8 @@ k8s.io/kube-openapi v0.0.0-20201113171705-d219536bb9fd h1:sOHNzJIkytDF6qadMNKhhD
 k8s.io/kube-openapi v0.0.0-20201113171705-d219536bb9fd/go.mod h1:WOJ3KddDSol4tAGcJo0Tvi+dK12EcqSLqcWsryKMpfM=
 k8s.io/utils v0.0.0-20201110183641-67b214c5f920 h1:CbnUZsM497iRC5QMVkHwyl8s2tB3g7yaSHkYPkpgelw=
 k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-knative.dev/hack v0.0.0-20210609124042-e35bcb8f21ec h1:6+/kYzOv4SSgzvJer3fZS22pzXQG0haZdue2FsheNrM=
-knative.dev/hack v0.0.0-20210609124042-e35bcb8f21ec/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
+knative.dev/hack v0.0.0-20210610231243-3d4b264d9472 h1:sPXp3IChxDMPFRyP9LGvb+hoa6xP9NhnLhT16Y6Icx0=
+knative.dev/hack v0.0.0-20210610231243-3d4b264d9472/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
 pgregory.net/rapid v0.3.3 h1:jCjBsY4ln4Atz78QoBWxUEvAHaFyNDQg9+WU62aCn1U=
 pgregory.net/rapid v0.3.3/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
diff --git a/vendor/knative.dev/hack/library.sh b/vendor/knative.dev/hack/library.sh
index fb41fd963..65fcb1549 100644
--- a/vendor/knative.dev/hack/library.sh
+++ b/vendor/knative.dev/hack/library.sh
@@ -773,9 +773,14 @@ function get_latest_knative_yaml_source() {
 function shellcheck_new_files() {
   declare -a array_of_files
   local failed=0
+
+  if [ -z "$SHELLCHECK_IGNORE_FILES" ]; then
+    SHELLCHECK_IGNORE_FILES="^vendor/"
+  fi
+
   readarray -t array_of_files < <(list_changed_files)
   for filename in "${array_of_files[@]}"; do
-    if echo "${filename}" | grep -q "^vendor/"; then
+    if echo "${filename}" | grep -q "$SHELLCHECK_IGNORE_FILES"; then
       continue
     fi
     if file "${filename}" | grep -q "shell script"; then
diff --git a/vendor/knative.dev/hack/release.sh b/vendor/knative.dev/hack/release.sh
index 025fcab14..98a20e8ad 100644
--- a/vendor/knative.dev/hack/release.sh
+++ b/vendor/knative.dev/hack/release.sh
@@ -18,6 +18,7 @@
 # See README.md for instructions on how to use it.
 
 source $(dirname "${BASH_SOURCE[0]}")/library.sh
+set -x
 
 # Organization name in GitHub; defaults to Knative.
 readonly ORG_NAME="${ORG_NAME:-knative}"
@@ -114,8 +115,11 @@ function hub_tool() {
 # Parameters: $1..$n - arguments to "git push <repo>".
 function git_push() {
   local repo_url="${REPO_UPSTREAM}"
-  [[ -n "${GITHUB_TOKEN}}" ]] && repo_url="${repo_url/:\/\//:\/\/${GITHUB_TOKEN}@}"
-  git push "${repo_url}" $@
+  local git_args=$@
+  # Subshell (parentheses) used to prevent GITHUB_TOKEN from printing in log
+  (set +x;
+   [[ -n "${GITHUB_TOKEN}}" ]] && repo_url="${repo_url/:\/\//:\/\/${GITHUB_TOKEN}@}";
+   git push "${repo_url}" ${git_args} )
 }
 
 # Return the master version of a release.
@@ -359,9 +363,14 @@ function parse_flags() {
         case ${parameter} in
           --github-token)
             [[ ! -f "$1" ]] && abort "file $1 doesn't exist"
+            local old="$(set +o)"
+            # Prevent GITHUB_TOKEN from printing in log
+            set +x
             # Remove any trailing newline/space from token
+            # ^ (That's not what echo -n does, it just doesn't *add* a newline, but I'm leaving it)
             GITHUB_TOKEN="$(echo -n $(cat "$1"))"
             [[ -n "${GITHUB_TOKEN}" ]] || abort "file $1 is empty"
+            eval "$old" # restore xtrace status
             ;;
           --release-gcr)
             KO_DOCKER_REPO=$1
diff --git a/vendor/modules.txt b/vendor/modules.txt
index e77eeb55f..d8efc036b 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -956,7 +956,7 @@ k8s.io/utils/buffer
 k8s.io/utils/integer
 k8s.io/utils/pointer
 k8s.io/utils/trace
-# knative.dev/hack v0.0.0-20210609124042-e35bcb8f21ec
+# knative.dev/hack v0.0.0-20210610231243-3d4b264d9472
 ## explicit
 knative.dev/hack
 # sigs.k8s.io/structured-merge-diff/v4 v4.0.3
diff --git a/webhook/configmaps/configmaps.go b/webhook/configmaps/configmaps.go
index c90f3b2e7..4d7ea5bfd 100644
--- a/webhook/configmaps/configmaps.go
+++ b/webhook/configmaps/configmaps.go
@@ -137,9 +137,13 @@ func (ac *reconciler) reconcileValidatingWebhook(ctx context.Context, caCert []b
 
 	webhook := configuredWebhook.DeepCopy()
 
-	// Clear out any previous (bad) OwnerReferences.
-	// See: https://github.com/knative/serving/issues/5845
-	webhook.OwnerReferences = nil
+	// Set the owner to namespace.
+	ns, err := ac.client.CoreV1().Namespaces().Get(ctx, system.Namespace(), metav1.GetOptions{})
+	if err != nil {
+		return fmt.Errorf("failed to fetch namespace: %w", err)
+	}
+	nsRef := *metav1.NewControllerRef(ns, corev1.SchemeGroupVersion.WithKind("Namespace"))
+	webhook.OwnerReferences = []metav1.OwnerReference{nsRef}
 
 	for i, wh := range webhook.Webhooks {
 		if wh.Name != webhook.Name {
diff --git a/webhook/resourcesemantics/defaulting/defaulting.go b/webhook/resourcesemantics/defaulting/defaulting.go
index d57cc41f1..a5bcc4137 100644
--- a/webhook/resourcesemantics/defaulting/defaulting.go
+++ b/webhook/resourcesemantics/defaulting/defaulting.go
@@ -30,6 +30,7 @@ import (
 	jsonpatch "gomodules.xyz/jsonpatch/v2"
 	admissionv1 "k8s.io/api/admission/v1"
 	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
@@ -172,9 +173,12 @@ func (ac *reconciler) reconcileMutatingWebhook(ctx context.Context, caCert []byt
 
 	current := configuredWebhook.DeepCopy()
 
-	// Clear out any previous (bad) OwnerReferences.
-	// See: https://github.com/knative/serving/issues/5845
-	current.OwnerReferences = nil
+	ns, err := ac.client.CoreV1().Namespaces().Get(ctx, system.Namespace(), metav1.GetOptions{})
+	if err != nil {
+		return fmt.Errorf("failed to fetch namespace: %w", err)
+	}
+	nsRef := *metav1.NewControllerRef(ns, corev1.SchemeGroupVersion.WithKind("Namespace"))
+	current.OwnerReferences = []metav1.OwnerReference{nsRef}
 
 	for i, wh := range current.Webhooks {
 		if wh.Name != current.Name {
diff --git a/webhook/resourcesemantics/validation/reconcile_config.go b/webhook/resourcesemantics/validation/reconcile_config.go
index 7d1a7adcf..0078b61ce 100644
--- a/webhook/resourcesemantics/validation/reconcile_config.go
+++ b/webhook/resourcesemantics/validation/reconcile_config.go
@@ -25,6 +25,7 @@ import (
 	"github.com/gobuffalo/flect"
 	"go.uber.org/zap"
 	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
@@ -135,9 +136,13 @@ func (ac *reconciler) reconcileValidatingWebhook(ctx context.Context, caCert []b
 
 	current := configuredWebhook.DeepCopy()
 
-	// Clear out any previous (bad) OwnerReferences.
-	// See: https://github.com/knative/serving/issues/5845
-	current.OwnerReferences = nil
+	// Set the owner to namespace.
+	ns, err := ac.client.CoreV1().Namespaces().Get(ctx, system.Namespace(), metav1.GetOptions{})
+	if err != nil {
+		return fmt.Errorf("failed to fetch namespace: %w", err)
+	}
+	nsRef := *metav1.NewControllerRef(ns, corev1.SchemeGroupVersion.WithKind("Namespace"))
+	current.OwnerReferences = []metav1.OwnerReference{nsRef}
 
 	for i, wh := range current.Webhooks {
 		if wh.Name != current.Name {


Test patch:
diff --git a/webhook/configmaps/table_test.go b/webhook/configmaps/table_test.go
index 4f41f865b..ad7992e3c 100644
--- a/webhook/configmaps/table_test.go
+++ b/webhook/configmaps/table_test.go
@@ -60,6 +60,14 @@ func TestReconcile(t *testing.T) {
 		},
 	}
 
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: system.Namespace(),
+		},
+	}
+	nsRef := *metav1.NewControllerRef(ns, corev1.SchemeGroupVersion.WithKind("Namespace"))
+	expectedOwnerReferences := []metav1.OwnerReference{nsRef}
+
 	ruleScope := admissionregistrationv1.NamespacedScope
 
 	// These are the rules we expect given the context of "validations".
@@ -104,7 +112,7 @@ func TestReconcile(t *testing.T) {
 	}, {
 		Name: "secret and VWH exist, missing service reference",
 		Key:  key,
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: name,
@@ -118,7 +126,7 @@ func TestReconcile(t *testing.T) {
 	}, {
 		Name: "secret and VWH exist, missing other stuff",
 		Key:  key,
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: name,
@@ -137,7 +145,8 @@ func TestReconcile(t *testing.T) {
 		WantUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: &admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
-					Name: name,
+					Name:            name,
+					OwnerReferences: expectedOwnerReferences,
 				},
 				Webhooks: []admissionregistrationv1.ValidatingWebhook{{
 					Name: name,
@@ -159,7 +168,7 @@ func TestReconcile(t *testing.T) {
 	}, {
 		Name: "secret and VWH exist, added fields are incorrect",
 		Key:  key,
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: name,
@@ -191,7 +200,8 @@ func TestReconcile(t *testing.T) {
 		WantUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: &admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
-					Name: name,
+					Name:            name,
+					OwnerReferences: expectedOwnerReferences,
 				},
 				Webhooks: []admissionregistrationv1.ValidatingWebhook{{
 					Name: name,
@@ -217,7 +227,7 @@ func TestReconcile(t *testing.T) {
 		WithReactors: []clientgotesting.ReactionFunc{
 			InduceFailure("update", "validatingwebhookconfigurations"),
 		},
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: name,
@@ -249,7 +259,8 @@ func TestReconcile(t *testing.T) {
 		WantUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: &admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
-					Name: name,
+					Name:            name,
+					OwnerReferences: expectedOwnerReferences,
 				},
 				Webhooks: []admissionregistrationv1.ValidatingWebhook{{
 					Name: name,
@@ -271,10 +282,11 @@ func TestReconcile(t *testing.T) {
 	}, {
 		Name: ":fire: everything is fine :fire:",
 		Key:  key,
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
-					Name: name,
+					Name:            name,
+					OwnerReferences: expectedOwnerReferences,
 				},
 				Webhooks: []admissionregistrationv1.ValidatingWebhook{{
 					Name: name,
diff --git a/webhook/resourcesemantics/defaulting/table_test.go b/webhook/resourcesemantics/defaulting/table_test.go
index 99f205631..1c7fa107d 100644
--- a/webhook/resourcesemantics/defaulting/table_test.go
+++ b/webhook/resourcesemantics/defaulting/table_test.go
@@ -60,6 +60,13 @@ func TestReconcile(t *testing.T) {
 			certresources.CACert:     []byte("present"),
 		},
 	}
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: system.Namespace(),
+		},
+	}
+	nsRef := *metav1.NewControllerRef(ns, corev1.SchemeGroupVersion.WithKind("Namespace"))
+	expectedOwnerReferences := []metav1.OwnerReference{nsRef}
 
 	// This is the namespace selector setup
 	namespaceSelector := &metav1.LabelSelector{
@@ -131,7 +138,7 @@ func TestReconcile(t *testing.T) {
 	}, {
 		Name: "secret and MWH exist, missing service reference",
 		Key:  key,
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.MutatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: name,
@@ -145,7 +152,7 @@ func TestReconcile(t *testing.T) {
 	}, {
 		Name: "secret and MWH exist, missing other stuff",
 		Key:  key,
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.MutatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: name,
@@ -164,7 +171,8 @@ func TestReconcile(t *testing.T) {
 		WantUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: &admissionregistrationv1.MutatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
-					Name: name,
+					Name:            name,
+					OwnerReferences: expectedOwnerReferences,
 				},
 				Webhooks: []admissionregistrationv1.MutatingWebhook{{
 					Name: name,
@@ -187,7 +195,7 @@ func TestReconcile(t *testing.T) {
 	}, {
 		Name: "secret and MWH exist, added fields are incorrect",
 		Key:  key,
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.MutatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: name,
@@ -219,7 +227,8 @@ func TestReconcile(t *testing.T) {
 		WantUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: &admissionregistrationv1.MutatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
-					Name: name,
+					Name:            name,
+					OwnerReferences: expectedOwnerReferences,
 				},
 				Webhooks: []admissionregistrationv1.MutatingWebhook{{
 					Name: name,
@@ -246,7 +255,7 @@ func TestReconcile(t *testing.T) {
 		WithReactors: []clientgotesting.ReactionFunc{
 			InduceFailure("update", "mutatingwebhookconfigurations"),
 		},
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.MutatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: name,
@@ -278,7 +287,8 @@ func TestReconcile(t *testing.T) {
 		WantUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: &admissionregistrationv1.MutatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
-					Name: name,
+					Name:            name,
+					OwnerReferences: expectedOwnerReferences,
 				},
 				Webhooks: []admissionregistrationv1.MutatingWebhook{{
 					Name: name,
@@ -301,10 +311,11 @@ func TestReconcile(t *testing.T) {
 	}, {
 		Name: ":fire: everything is fine :fire:",
 		Key:  key,
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.MutatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
-					Name: name,
+					Name:            name,
+					OwnerReferences: expectedOwnerReferences,
 				},
 				Webhooks: []admissionregistrationv1.MutatingWebhook{{
 					Name: name,
@@ -336,7 +347,7 @@ func TestReconcile(t *testing.T) {
 	}, {
 		Name: "secret and MWH exist, correcting namespaceSelector",
 		Key:  key,
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.MutatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: name,
@@ -371,7 +382,8 @@ func TestReconcile(t *testing.T) {
 		WantUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: &admissionregistrationv1.MutatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
-					Name: name,
+					Name:            name,
+					OwnerReferences: expectedOwnerReferences,
 				},
 				Webhooks: []admissionregistrationv1.MutatingWebhook{{
 					Name: name,
diff --git a/webhook/resourcesemantics/validation/reconcile_config_test.go b/webhook/resourcesemantics/validation/reconcile_config_test.go
index 8ce774c3e..fd4c93163 100644
--- a/webhook/resourcesemantics/validation/reconcile_config_test.go
+++ b/webhook/resourcesemantics/validation/reconcile_config_test.go
@@ -61,6 +61,14 @@ func TestReconcile(t *testing.T) {
 		},
 	}
 
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: system.Namespace(),
+		},
+	}
+	nsRef := *metav1.NewControllerRef(ns, corev1.SchemeGroupVersion.WithKind("Namespace"))
+	expectedOwnerReferences := []metav1.OwnerReference{nsRef}
+
 	// This is the namespace selector setup
 	namespaceSelector := &metav1.LabelSelector{
 		MatchExpressions: []metav1.LabelSelectorRequirement{{
@@ -131,7 +139,7 @@ func TestReconcile(t *testing.T) {
 	}, {
 		Name: "secret and VWH exist, missing service reference",
 		Key:  key,
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: name,
@@ -145,7 +153,7 @@ func TestReconcile(t *testing.T) {
 	}, {
 		Name: "secret and VWH exist, missing other stuff",
 		Key:  key,
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: name,
@@ -164,7 +172,8 @@ func TestReconcile(t *testing.T) {
 		WantUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: &admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
-					Name: name,
+					Name:            name,
+					OwnerReferences: expectedOwnerReferences,
 				},
 				Webhooks: []admissionregistrationv1.ValidatingWebhook{{
 					Name: name,
@@ -187,7 +196,7 @@ func TestReconcile(t *testing.T) {
 	}, {
 		Name: "secret and VWH exist, added fields are incorrect",
 		Key:  key,
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: name,
@@ -219,7 +228,8 @@ func TestReconcile(t *testing.T) {
 		WantUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: &admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
-					Name: name,
+					Name:            name,
+					OwnerReferences: expectedOwnerReferences,
 				},
 				Webhooks: []admissionregistrationv1.ValidatingWebhook{{
 					Name: name,
@@ -246,7 +256,7 @@ func TestReconcile(t *testing.T) {
 		WithReactors: []clientgotesting.ReactionFunc{
 			InduceFailure("update", "validatingwebhookconfigurations"),
 		},
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: name,
@@ -278,7 +288,8 @@ func TestReconcile(t *testing.T) {
 		WantUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: &admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
-					Name: name,
+					Name:            name,
+					OwnerReferences: expectedOwnerReferences,
 				},
 				Webhooks: []admissionregistrationv1.ValidatingWebhook{{
 					Name: name,
@@ -301,10 +312,11 @@ func TestReconcile(t *testing.T) {
 	}, {
 		Name: ":fire: everything is fine :fire:",
 		Key:  key,
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
-					Name: name,
+					Name:            name,
+					OwnerReferences: expectedOwnerReferences,
 				},
 				Webhooks: []admissionregistrationv1.ValidatingWebhook{{
 					Name: name,
@@ -336,7 +348,7 @@ func TestReconcile(t *testing.T) {
 	}, {
 		Name: "secret and VWH exist, correcting namespaceSelector",
 		Key:  key,
-		Objects: []runtime.Object{secret,
+		Objects: []runtime.Object{secret, ns,
 			&admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: name,
@@ -371,7 +383,8 @@ func TestReconcile(t *testing.T) {
 		WantUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: &admissionregistrationv1.ValidatingWebhookConfiguration{
 				ObjectMeta: metav1.ObjectMeta{
-					Name: name,
+					Name:            name,
+					OwnerReferences: expectedOwnerReferences,
 				},
 				Webhooks: []admissionregistrationv1.ValidatingWebhook{{
 					Name: name,