feat: add scheduler enforcement rule (#1971)

* fix(controller): decode old object for delete requests Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix: preserve ca-bundles injected from external providers Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: abstract ruling Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: migrate events api * feat: migrate events api * feat: migrate events api * feat: migrate events api * feat: migrate events api * feat: migrate events api * feat: migrate events api * feat: migrate events api * feat: migrate events api * feat: migrate events api --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
2026-08-25 16:07:24 +00:00 · 2026-06-19 14:34:16 +02:00
parent 8a7f8a9388
commit 0b11582e4a
120 changed files with 6616 additions and 1528 deletions
@@ -89,40 +89,12 @@ spec:
      kind: User
      name: alice
  rules:
-    - permissions:
-        promotions:
-          - clusterRoles:
-            - "admin"
-            selector:
-              matchLabels:
-                owner.projectcapsule.dev/role: "replication"
-
-    - enforce:
-        action: "allow"
-        workloads:
-          registries:
-          - exp: ".*"
-    - enforce:
-        action: "deny"
-        workloads:
-          registries:
-          - exp: "harbor/.*"
-    - enforce:
-        action: "deny"
-        workloads:
-          registries:
-          - exp: "harbor/customer/.*"
-    - namespaceSelector:
-        matchExpressions:
-          - key: env
-            operator: In
-            values:
-            - "prod"
-      enforce:
-        action: "allow"
-        workloads:
-          registries:
-          - exp: "harbor/customer/prod-image/.*"
+  - enforce:
+      action: "allow"
+      workloads:
+        schedulers:
+        - exact:
+            - "{{ .tenant.metadata.name }}-scheduler"
 ---
 apiVersion: capsule.clastix.io/v1beta2
 kind: Tenant