mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 14:02:56 +09:00
Myasnikov Daniil
0c17d1870c
Block accidental DELETE on critical platform objects (tenant-root, cozy-system, LinstorCluster, CRDs, ClusterIssuers, cozystack-version ConfigMap, cozystack-packages OCIRepository, tenant-root HelmRelease) via a label-scoped ValidatingAdmissionPolicy. No webhook DaemonSet, Service, TLS, or image — the API server evaluates the CEL expression in-process. Requires Kubernetes 1.30+. Bypass for legitimate deletes is two steps: kubectl label <kind> <name> platform.cozystack.io/no-delete- kubectl delete <kind> <name> CRDs installed dynamically by the operator get the label stamped in internal/crdinstall/install.go before the apply call. Release note: Added deletion-protection guardrail (ValidatingAdmissionPolicy) blocking DELETE on cozystack platform objects labeled platform.cozystack.io/no-delete=true. Bypass by removing the label first. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
16 lines
396 B
YAML
16 lines
396 B
YAML
{{- $configMap := lookup "v1" "ConfigMap" .Release.Namespace "cozystack-version" }}
|
|
{{- if not $configMap }}
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: cozystack-version
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
platform.cozystack.io/no-delete: "true"
|
|
annotations:
|
|
helm.sh/resource-policy: keep
|
|
data:
|
|
version: {{ .Values.migrations.targetVersion | quote }}
|
|
{{- end }}
|