issue-747: add ValidatingAdmissionPolicy

charts/moco/templates/generated/generated.yaml

@@ -373,6 +373,50 @@ spec:
     app.kubernetes.io/name: '{{ include "moco.name" . }}'
 ---
 apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: '{{ .Release.Service }}'
+    app.kubernetes.io/name: '{{ include "moco.name" . }}'
+    app.kubernetes.io/version: '{{ .Chart.AppVersion }}'
+    helm.sh/chart: '{{ include "moco.chart" . }}'
+  name: moco-delete-validator
+  namespace: '{{ .Release.Namespace }}'
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+      - apiGroups:
+          - ""
+        apiVersions:
+          - '*'
+        operations:
+          - DELETE
+        resources:
+          - pods
+  validations:
+    - expression: |
+        !has(oldObject.metadata.annotations) ||
+        !("moco.cybozu.com/prevent" in oldObject.metadata.annotations) ||
+        !(oldObject.metadata.annotations["moco.cybozu.com/prevent"] == "delete")
+      messageExpression: oldObject.metadata.name + ' is protected from deletion'
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: '{{ .Release.Service }}'
+    app.kubernetes.io/name: '{{ include "moco.name" . }}'
+    app.kubernetes.io/version: '{{ .Chart.AppVersion }}'
+    helm.sh/chart: '{{ include "moco.chart" . }}'
+  name: moco-delete-validator
+  namespace: '{{ .Release.Namespace }}'
+spec:
+  policyName: moco-delete-validator
+  validationActions:
+    - Deny
+---
+apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
   annotations:

config/webhook/kustomization.yaml

@@ -1,6 +1,7 @@
 resources:
 - manifests.yaml
 - service.yaml
+- validate_preventdelete.yaml
 
 configurations:
 - kustomizeconfig.yaml

config/webhook/validate_preventdelete.yaml

@@ -0,0 +1,27 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: delete-validator
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+      - apiGroups: [""]
+        apiVersions: ["*"]
+        operations: ["DELETE"]
+        resources: ["pods"]
+  validations:
+    - expression: |
+        !has(oldObject.metadata.annotations) ||
+        !("moco.cybozu.com/prevent" in oldObject.metadata.annotations) ||
+        !(oldObject.metadata.annotations["moco.cybozu.com/prevent"] == "delete")
+      messageExpression: oldObject.metadata.name + ' is protected from deletion'
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: delete-validator
+spec:
+  policyName: moco-delete-validator
+  validationActions:
+    - Deny