fix(validation): #696 drop deletion requests if the resources with an…

…notation ignore-deletion
oceanbase · Dec 25, 2024 · 5c67edf · 5c67edf
1 parent edf3f1e
commit 5c67edf
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 3 deletions.
diff --git a/api/v1alpha1/obcluster_webhook.go b/api/v1alpha1/obcluster_webhook.go
@@ -162,7 +162,7 @@ func (r *OBCluster) Default() {
 }
 
 // TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-oceanbase-oceanbase-com-v1alpha1-obcluster,mutating=false,failurePolicy=fail,sideEffects=None,groups=oceanbase.oceanbase.com,resources=obclusters,verbs=create;update,versions=v1alpha1,name=vobcluster.kb.io,admissionReviewVersions=v1
+//+kubebuilder:webhook:path=/validate-oceanbase-oceanbase-com-v1alpha1-obcluster,mutating=false,failurePolicy=fail,sideEffects=None,groups=oceanbase.oceanbase.com,resources=obclusters,verbs=create;update;delete,versions=v1alpha1,name=vobcluster.kb.io,admissionReviewVersions=v1
 
 var _ webhook.Validator = &OBCluster{}
 
@@ -267,6 +267,9 @@ func (r *OBCluster) ValidateUpdate(old runtime.Object) (admission.Warnings, erro
 
 // ValidateDelete implements webhook.Validator so a webhook will be registered for the type
 func (r *OBCluster) ValidateDelete() (admission.Warnings, error) {
+	if r.Annotations[oceanbaseconst.AnnotationsIgnoreDeletion] == "true" {
+		return nil, apierrors.NewBadRequest("OBCluster " + r.Name + " is protected from deletion by annotation " + oceanbaseconst.AnnotationsIgnoreDeletion)
+	}
 	return nil, nil
 }
 

diff --git a/api/v1alpha1/obtenant_webhook.go b/api/v1alpha1/obtenant_webhook.go
@@ -98,7 +98,7 @@ func (r *OBTenant) Default() {
 }
 
 // TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-oceanbase-oceanbase-com-v1alpha1-obtenant,mutating=false,failurePolicy=fail,sideEffects=None,groups=oceanbase.oceanbase.com,resources=obtenants,verbs=create;update,versions=v1alpha1,name=vobtenant.kb.io,admissionReviewVersions=v1
+//+kubebuilder:webhook:path=/validate-oceanbase-oceanbase-com-v1alpha1-obtenant,mutating=false,failurePolicy=fail,sideEffects=None,groups=oceanbase.oceanbase.com,resources=obtenants,verbs=create;update;delete,versions=v1alpha1,name=vobtenant.kb.io,admissionReviewVersions=v1
 
 var _ webhook.Validator = &OBTenant{}
 
@@ -311,7 +311,9 @@ func (r *OBTenant) validateMutation() error {
 
 // ValidateDelete implements webhook.Validator so a webhook will be registered for the type
 func (r *OBTenant) ValidateDelete() (admission.Warnings, error) {
-	// TODO(user): fill in your validation logic upon object deletion.
+	if r.Annotations[oceanbaseconst.AnnotationsIgnoreDeletion] == "true" {
+		return nil, apierrors.NewBadRequest("OBTenant " + r.Name + " is protected from deletion by annotation " + oceanbaseconst.AnnotationsIgnoreDeletion)
+	}
 	return nil, nil
 }
 

diff --git a/config/webhook/manifests.yaml b/config/webhook/manifests.yaml
@@ -187,6 +187,7 @@ webhooks:
     operations:
     - CREATE
     - UPDATE
+    - DELETE
     resources:
     - obclusters
   sideEffects: None
@@ -247,6 +248,7 @@ webhooks:
     operations:
     - CREATE
     - UPDATE
+    - DELETE
     resources:
     - obtenants
   sideEffects: None