diff --git a/src/test/ks-core/files/extensions.customresourcefilters.rego b/src/test/ks-core/files/extensions.customresourcefilters.rego
index cdd01b11..08e1be86 100644
--- a/src/test/ks-core/files/extensions.customresourcefilters.rego
+++ b/src/test/ks-core/files/extensions.customresourcefilters.rego
@@ -36,6 +36,11 @@ match if {
 	installStatusMatch
 }
 
+match if {
+	installStatusSearch
+	installedStatusMatch
+}
+
 match if {
 	enabledStatusSearch
 	enabledStatusMatch
@@ -67,6 +72,11 @@ installStatusMatch if {
 	lower(input.object.status.state) == lower(input.filter.value)
 }
 
+installedStatusMatch if {
+    input.filter.value == "installed"
+    ["Installed","Enabled","Disabled"][_] == input.object.status.state
+}
+
 enabledStatusMatch if {
 	input.filter.value == "true" == input.object.status.enabled
 }
diff --git a/src/test/ks-core/templates/webhook.yaml b/src/test/ks-core/templates/webhook.yaml
index 0fd1e180..0349452d 100644
--- a/src/test/ks-core/templates/webhook.yaml
+++ b/src/test/ks-core/templates/webhook.yaml
@@ -334,7 +334,10 @@ webhooks:
     failurePolicy: Ignore
     matchPolicy: Exact
     namespaceSelector: {}
-    objectSelector: {}
+    objectSelector:
+      matchExpressions:
+        - key: cluster-role.kubesphere.io/host
+          operator: DoesNotExist
     rules:
       - apiGroups:
           - cluster.kubesphere.io