{
  "repo": "tidbcloud/tidb-operator-cse",
  "binary": "admission-webhook",
  "binary_path": "cmd/admission-webhook/main.go",
  "dependencies": {
    "AdmissionWebhookLifecycle.StartAdmissionServer": {
      "infrastructure": {},
      "services": []
    },
    "NamespaceAdmissionWebhook.ValidateProtectedNamespaceDeletion": {
      "infrastructure": {},
      "services": []
    },
    "StatefulSetAdmissionWebhook.ValidateStatefulSetPartition": {
      "infrastructure": {
        "operator_api": [
          {
            "operation": "GET TidbCluster",
            "target": "pingcap.com/v1alpha1 TidbCluster",
            "conditions": [
              "Only when the incoming StatefulSet belongs to a TiDB or TiKV component managed by TidbCluster"
            ],
            "implementation": "pkg/webhook/statefulset/statefulset.go:104"
          }
        ]
      },
      "services": []
    },
    "StrategyAdmissionWebhook.ValidatePingcapResource": {
      "infrastructure": {},
      "services": []
    },
    "StrategyAdmissionWebhook.MutatePingcapResource": {
      "infrastructure": {},
      "services": []
    }
  },
  "notes": [
    "Namespace validation is purely local: it checks the protected namespace set built from flags and the NAMESPACE environment variable.",
    "StatefulSet validation is the only webhook in this binary that makes an additional apiserver call during request handling, fetching the owning TidbCluster to enforce partition protection.",
    "Strategy validation and mutation operate over the in-process strategy registry and do not call external services directly."
  ]
}