Hao Zhou

I think this should be handled at CRD validation instead of expecting the controller that watches on the CRD to handle malformed objects. Otherwise the malformed objects can break all...

@jonathan-innis , yes, the webhook is assuming all pods are not static pods and should be assigned with a Service Account. As discussed offline, so far we are not seeing...

>to enforce Security Groups for Pods If this is regarding static pods to use Security Group for Pods, this is not a case we were supporting or testing. Who sets...

Thanks for checking. It makes sense to me that static pods' networking are setup by the same path. I have no problem to remove the forced SA check on pods....