From da78423f426cddc685370d479770a5a621244bd1 Mon Sep 17 00:00:00 2001
From: Dario Tranchitella <dario@tranchitella.eu>
Date: Thu, 2 Mar 2023 11:30:50 +0100
Subject: [PATCH] fix: preventing index out of range when sa is impersonating

---
 pkg/webhook/utils/is_capsule_user.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/webhook/utils/is_capsule_user.go b/pkg/webhook/utils/is_capsule_user.go
index aeb37476..ede65b11 100644
--- a/pkg/webhook/utils/is_capsule_user.go
+++ b/pkg/webhook/utils/is_capsule_user.go
@@ -28,9 +28,9 @@ func IsCapsuleUser(ctx context.Context, req admission.Request, clt client.Client
 	if sets.NewString(req.UserInfo.Groups...).Has("system:serviceaccounts") {
 		parts := strings.Split(req.UserInfo.Username, ":")
 
-		targetNamespace := parts[2]
+		if len(parts) == 4 {
+			targetNamespace := parts[2]
 
-		if len(targetNamespace) > 0 {
 			tl := &capsulev1beta2.TenantList{}
 			if err := clt.List(ctx, tl, client.MatchingFieldsSelector{Selector: fields.OneTermEqualSelector(".status.namespaces", targetNamespace)}); err != nil {
 				return false