chore: add deprecation notices (#2089)

* fix: revert pv labeling to dircet api reads

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: revert pv labeling to dircet api reads

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add deprecation warnings

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* chore: implement playground

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* chore: implement playground

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

---------

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

api/v1beta2/namespace_options.go

@@ -11,18 +11,26 @@ type NamespaceOptions struct {
 	// +kubebuilder:validation:Minimum=1
 	// Specifies the maximum number of namespaces allowed for that Tenant. Once the namespace quota assigned to the Tenant has been reached, the Tenant owner cannot create further namespaces. Optional.
 	Quota *int32 `json:"quota,omitempty"`
-	// Deprecated: Use additionalMetadataList instead (https://projectcapsule.dev/docs/tenants/metadata/#additionalmetadatalist)
+	// Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace)
 	//
 	// Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant. Optional.
 	AdditionalMetadata *api.AdditionalMetadataSpec `json:"additionalMetadata,omitempty"`
+	// Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace)
+	//
 	// Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant via a list. Optional.
 	AdditionalMetadataList []api.AdditionalMetadataSelectorSpec `json:"additionalMetadataList,omitempty"`
+	// Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace)
+	//
 	// Required Metadata for namespace within this tenant
 	// +optional
 	RequiredMetadata *RequiredMetadata `json:"requiredMetadata,omitzero"`
+	// Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace)
+	//
 	// Define the labels that a Tenant Owner cannot set for their Namespace resources.
 	// +optional
 	ForbiddenLabels api.ForbiddenListSpec `json:"forbiddenLabels,omitzero"`
+	// Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace)
+	//
 	// Define the annotations that a Tenant Owner cannot set for their Namespace resources.
 	// +optional
 	ForbiddenAnnotations api.ForbiddenListSpec `json:"forbiddenAnnotations,omitzero"`

api/v1beta2/tenant_types.go

@@ -40,10 +40,6 @@ type TenantSpec struct {
 	Owners rbac.OwnerListSpec `json:"owners,omitempty"`
 	// Specifies options for the Namespaces, such as additional metadata or maximum number of namespaces allowed for that Tenant. Once the namespace quota assigned to the Tenant has been reached, the Tenant owner cannot create further namespaces. Optional.
 	NamespaceOptions *NamespaceOptions `json:"namespaceOptions,omitempty"`
-	// Specifies options for the Service, such as additional metadata or block of certain type of Services. Optional.
-	ServiceOptions *api.ServiceOptions `json:"serviceOptions,omitempty"`
-	// Specifies options for the Pods deployed in the Tenant namespaces, such as additional metadata.
-	PodOptions *api.PodOptions `json:"podOptions,omitempty"`
 	// Specifies the allowed StorageClasses assigned to the Tenant.
 	// Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses.
 	// A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class.
@@ -54,9 +50,6 @@ type TenantSpec struct {
 	IngressOptions IngressOptions `json:"ingressOptions,omitzero"`
 	// Specifies the label to control the placement of pods on a given pool of worker nodes. All namespaces created within the Tenant will have the node selector annotation. This annotation tells the Kubernetes scheduler to place pods on the nodes having the selector label. Optional.
 	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
-	// Specifies a list of ResourceQuota resources assigned to the Tenant. The assigned values are inherited by any namespace created in the Tenant. The Capsule operator aggregates ResourceQuota at Tenant level, so that the hard quota is never crossed for the given Tenant. This permits the Tenant owner to consume resources in the Tenant regardless of the namespace. Optional.
-	// +optional
-	ResourceQuota api.ResourceQuotaSpec `json:"resourceQuotas,omitzero"`
 	// Specifies additional RoleBindings assigned to the Tenant. Capsule will ensure that all namespaces in the Tenant always contain the RoleBinding for the given ClusterRole. Optional.
 	AdditionalRoleBindings []rbac.AdditionalRoleBindingsSpec `json:"additionalRoleBindings,omitempty"`
 	// Specifies the allowed RuntimeClasses assigned to the Tenant.
@@ -90,6 +83,19 @@ type TenantSpec struct {
 	// Optional
 	ForceTenantPrefix *bool `json:"forceTenantPrefix,omitempty"`
 
+	// Deprecated: Use Rules Quota (https://projectcapsule.dev/docs/tenants/rules/#quotas)
+	//
+	// Specifies a list of ResourceQuota resources assigned to the Tenant. The assigned values are inherited by any namespace created in the Tenant. The Capsule operator aggregates ResourceQuota at Tenant level, so that the hard quota is never crossed for the given Tenant. This permits the Tenant owner to consume resources in the Tenant regardless of the namespace. Optional.
+	// +optional
+	ResourceQuota api.ResourceQuotaSpec `json:"resourceQuotas,omitzero"`
+	// Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/)
+	//
+	// Specifies options for the Service, such as additional metadata or block of certain type of Services. Optional.
+	ServiceOptions *api.ServiceOptions `json:"serviceOptions,omitempty"`
+	// Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/)
+	//
+	// Specifies options for the Pods deployed in the Tenant namespaces, such as additional metadata.
+	PodOptions *api.PodOptions `json:"podOptions,omitempty"`
 	// Deprecated: Use Enforcement.Registries instead
 	//
 	// Specifies the trusted Image Registries assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed trusted registries. Optional.
@@ -98,7 +104,6 @@ type TenantSpec struct {
 	//
 	// Specify the allowed values for the imagePullPolicies option in Pod resources. Capsule assures that all Pod resources created in the Tenant can use only one of the allowed policy. Optional.
 	ImagePullPolicies []rules.ImagePullPolicySpec `json:"imagePullPolicies,omitempty"`
-
 	// Deprecated: Use Tenant Replications instead (https://projectcapsule.dev/docs/replications/)
 	//
 	// Specifies the NetworkPolicies assigned to the Tenant. The assigned NetworkPolicies are inherited by any namespace created in the Tenant. Optional.

api/v1beta2/zz_generated.deepcopy.go

@@ -2452,16 +2452,6 @@ func (in *TenantSpec) DeepCopyInto(out *TenantSpec) {
 		*out = new(NamespaceOptions)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.ServiceOptions != nil {
-		in, out := &in.ServiceOptions, &out.ServiceOptions
-		*out = new(api.ServiceOptions)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.PodOptions != nil {
-		in, out := &in.PodOptions, &out.PodOptions
-		*out = new(api.PodOptions)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.StorageClasses != nil {
 		in, out := &in.StorageClasses, &out.StorageClasses
 		*out = new(api.DefaultAllowedListSpec)
@@ -2475,7 +2465,6 @@ func (in *TenantSpec) DeepCopyInto(out *TenantSpec) {
 			(*out)[key] = val
 		}
 	}
-	in.ResourceQuota.DeepCopyInto(&out.ResourceQuota)
 	if in.AdditionalRoleBindings != nil {
 		in, out := &in.AdditionalRoleBindings, &out.AdditionalRoleBindings
 		*out = make([]rbac.AdditionalRoleBindingsSpec, len(*in))
@@ -2504,6 +2493,17 @@ func (in *TenantSpec) DeepCopyInto(out *TenantSpec) {
 		*out = new(bool)
 		**out = **in
 	}
+	in.ResourceQuota.DeepCopyInto(&out.ResourceQuota)
+	if in.ServiceOptions != nil {
+		in, out := &in.ServiceOptions, &out.ServiceOptions
+		*out = new(api.ServiceOptions)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.PodOptions != nil {
+		in, out := &in.PodOptions, &out.PodOptions
+		*out = new(api.PodOptions)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.ContainerRegistries != nil {
 		in, out := &in.ContainerRegistries, &out.ContainerRegistries
 		*out = new(api.AllowedListSpec)