CP-44602: Distinguish RBAC failure from a missing VWC in anaximander webhook config collection

[evan-cz]

Problem

The webhook-config.txt section of anaximander.sh reports "No ValidatingWebhookConfigurations found referencing namespace ..." whenever the cluster-scoped listing fails — for example when the collecting user lacks list permission on validatingwebhookconfigurations. The error was swallowed with 2>/dev/null || echo "", so a permission denial looked identical to a genuine absence, and the script then printed a definitive "the API server is not configured to send admission requests" conclusion — a false negative on a perfectly healthy deployment.

Two secondary weaknesses in the same block:

• The jsonpath matcher only inspected webhooks[0] and only service-based clientConfig, so it could miss the config or be tripped up by other controllers' webhook configurations in the cluster.
• The caBundle was read from webhooks[0] specifically.

Change

• List the VWCs as JSON with stdout and stderr kept separate and the exit status captured, so a permission/API failure, a parse failure, and a genuine absence are three distinct, clearly-labelled outcomes. stderr is never folded into the JSON (a kubectl warning on an otherwise-successful call would corrupt it).
• Match the webhook config by the chart label (app.kubernetes.io/part-of=cloudzero-agent) first, then fall back to any webhook entry whose service is in the agent namespace (jq-based, tolerant of other controllers' configs).
• Capture jq's exit status independently so a parse failure (e.g. jq not installed) is reported distinctly rather than mistaken for "none found".
• Read the caBundle from the first non-empty webhook entry.
• Only emit the definitive "no VWC" message when the listing succeeded and parsed cleanly and genuinely returned nothing; cross-reference the webhook "Pushing records" log line as a sanity check.

Verification

bash -n passes; behavioral fixtures for label-not-first, service-only, genuine absence, a Forbidden error, and a kubectl-warning-on-success (valid JSON) case are all classified correctly.

This PR was created with AI assistance (Claude Code by Anthropic).

[greptile-apps]

Greptile Summary

This PR refactors the webhook-config.txt collection section of anaximander.sh to correctly distinguish three outcomes when inspecting ValidatingWebhookConfigurations: an RBAC/API error, a jq parse failure, and a genuine absence. Previously, 2>/dev/null || echo "" silently swallowed permission denials and made them indistinguishable from "no webhook found," producing a misleading diagnosis on healthy deployments.

• kubectl stderr is now captured in a temp file so it never corrupts the JSON payload, and both VWC_RC and VWC_JQ_RC are preserved using || RC=$? to avoid triggering set -e on failures.
• The jq filter matches against all webhooks[*] entries (not just webhooks[0]) and checks the chart label first, then falls back to any service in the agent namespace.
• The caBundle is now read from the first non-empty entry across all webhook entries rather than being hard-coded to webhooks[0].

Confidence Score: 5/5

This is a diagnostic-script-only change with no impact on production control paths; the logic is well-reasoned and the set -e guard pattern is correctly applied.

The change is confined to a single diagnostic script section. The || RC=$? pattern correctly suppresses errexit for both the kubectl and jq invocations, and the three-way branching logic is sound. The only notable gap is that VWC_ERR_FILE could be leaked if an unguarded command in the same block triggers an early exit, but this is a minor temp-file hygiene issue in a once-per-run diagnostic tool, not a correctness or safety problem.

No files require special attention beyond the minor temp-file cleanup gap in scripts/anaximander.sh.

Important Files Changed

Filename	Overview
scripts/anaximander.sh	Distinguishes RBAC failure from genuine VWC absence by capturing kubectl stderr separately, using `

_{Reviews (3): Last reviewed commit: "CP-44602: Distinguish RBAC failure from ..." | Re-trigger Greptile}

[evan-cz]

@greptile review