chore(helm): blocking replicated resources write ops by tenant owners

charts/capsule/README.md

@@ -158,6 +158,7 @@ Here the values you can override:
 | webhooks.services.failurePolicy | string | `"Fail"` |  |
 | webhooks.services.namespaceSelector.matchExpressions[0].key | string | `"capsule.clastix.io/tenant"` |  |
 | webhooks.services.namespaceSelector.matchExpressions[0].operator | string | `"Exists"` |  |
+| webhooks.tenantResourceObjects.failurePolicy | string | `"Fail"` |  |
 | webhooks.tenants.failurePolicy | string | `"Fail"` |  |
 
 ## Created resources

charts/capsule/templates/validatingwebhookconfiguration.yaml

@@ -257,6 +257,38 @@ webhooks:
       scope: Namespaced
   sideEffects: None
   timeoutSeconds: {{ .Values.validatingWebhooksTimeoutSeconds }}
+- admissionReviewVersions:
+    - v1
+  clientConfig:
+{{- if not .Values.certManager.generateCertificates }}
+    caBundle: Cg==
+{{- end }}
+    service:
+      name: capsule-webhook-service
+      namespace: capsule-system
+      path: /tenantresource-objects
+  failurePolicy:  {{ .Values.webhooks.tenantResourceObjects.failurePolicy }}
+  name: resource-objects.tenant.capsule.clastix.io
+  namespaceSelector:
+    matchExpressions:
+      - key: capsule.clastix.io/tenant
+        operator: Exists
+  objectSelector:
+    matchExpressions:
+      - key: capsule.clastix.io/resources
+        operator: Exists
+  rules:
+    - apiGroups:
+        - '*'
+      apiVersions:
+        - '*'
+      operations:
+        - UPDATE
+        - DELETE
+      resources:
+        - '*'
+      scope: Namespaced
+  sideEffects: None
 - admissionReviewVersions:
     - v1
     - v1beta1

charts/capsule/values.yaml

@@ -188,6 +188,8 @@ webhooks:
           operator: Exists
   tenants:
     failurePolicy: Fail
+  tenantResourceObjects:
+    failurePolicy: Fail
   services:
     failurePolicy: Fail
     namespaceSelector: