[aditya-rai-5]

What

Fix quota admission rejecting an InferenceService immediately after its Namespace is created.

Why

The webhook reads Namespaces through the manager’s cache. A newly created Namespace may not have reached the cache, causing admission to fail with Namespace not found.

Fixes #2459

How

• Read Namespace existence and labels through mgr.GetAPIReader().
• Preserve admission denial when the Namespace lookup fails.
• Add regression tests for create/update admission, selector-based quota enforcement with fresh labels, and missing Namespaces.

Assisted-by: Codex (implemented the regression tests).

Checklist

• Tests added/updated
• make test passes locally
• make lint passes locally
• Commit messages follow conventional commits
• All commits are signed off (git commit -s) per DCO
• AI assistance (if any) is disclosed above, per CONTRIBUTING.md
• Documentation updated (if user-facing change)

[Defilan]

Thanks, this is the right fix. Reading the Namespace through mgr.GetAPIReader() removes the stale NotFound, and it also means a selector quota sees fresh labels. The operator already has get on namespaces, so no RBAC change is needed. The tests cover a brand new Namespace, stale labels and a Namespace that really is missing.

I've started CI. This can merge once it's green.

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...ernal/controller/inferenceservice_quota_webhook.go	80.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!