fix: bypass resourepool limits (#1669)

* fix: bypass resourepool limits

Signed-off-by: Hristo Hristov <me@hhristov.info>

* fix: bypass resourepool limits

Signed-off-by: Hristo Hristov <me@hhristov.info>

---------

Signed-off-by: Hristo Hristov <me@hhristov.info>

charts/capsule/templates/validatingwebhookconfiguration.yaml

@@ -480,6 +480,7 @@ webhooks:
       operations:
       - CREATE
       - UPDATE
+      - DELETE
       resources:
       - resourcepoolclaims
       scope: '*'

e2e/resourcepoolclaim_test.go

@@ -377,6 +377,16 @@ var _ = Describe("ResourcePoolClaim Tests", Label("resourcepool"), func() {
 			Expect(claim.Status.Pool).To(Equal(expectedPool), "expected pool name to match")
 		})
 
+		By("Error on deleting bound claim", func() {
+			err := k8sClient.Get(context.TODO(), client.ObjectKey{Name: claim.Name, Namespace: claim.Namespace}, claim)
+			Expect(err).Should(Succeed())
+
+			isBoundCondition(claim)
+
+			err = k8sClient.Delete(context.TODO(), claim)
+			Expect(err).ShouldNot(Succeed())
+		})
+
 		By("Error on patching resources for claim (Increase)", func() {
 			err := k8sClient.Get(context.TODO(), client.ObjectKey{Name: claim.Name, Namespace: claim.Namespace}, claim)
 			Expect(err).Should(Succeed())

pkg/webhook/resourcepool/claim_validating.go

@@ -32,8 +32,20 @@ func (h *claimValidationHandler) OnCreate(client.Client, admission.Decoder, reco
 	}
 }
 
-func (h *claimValidationHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func {
-	return func(context.Context, admission.Request) *admission.Response {
+func (h *claimValidationHandler) OnDelete(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func {
+	return func(_ context.Context, req admission.Request) *admission.Response {
+		claim := &capsulev1beta2.ResourcePoolClaim{}
+
+		if err := decoder.DecodeRaw(req.OldObject, claim); err != nil {
+			return utils.ErroredResponse(fmt.Errorf("failed to decode old object: %w", err))
+		}
+
+		if claim.IsBoundToResourcePool() {
+			response := admission.Denied(fmt.Sprintf("cannot delete the pool while claim is bound to a resourcepool %s", claim.Status.Pool.Name))
+
+			return &response
+		}
+
 		return nil
 	}
 }