Implement validation webhooks for `ClusterAdmissionPolicy`

flavio commented 3 years ago

We must provide a mutation webhook for the ClusterAdmissionPolicy resource.

The webhook will implement the following validations:

UPDATE operation: do not allow to change the name of the policy server where the policy is scheduled. If the user wants to change it he will have to delete the policy and create a new one. At least for now

The webhook will implement the following mutations:

CREATE operation: ensure the kubewarden finalizers are specified, if not, add them
CREATE operation: set the policyStatus to pending when a ClusterAdmissionPolicy is created

Note well: it's totally fine to create a ClusterAdmissionPolicy object that is scheduled on a non-existing PolicyServer.

raulcabello commented 3 years ago

I just updated the card to set the policy status to unscheduled more info https://github.com/kubewarden/kubewarden-controller/issues/72

viccuad commented 3 years ago

kubewarden / kubewarden-controller