feat: add metadata enforcement (#1990)

* fix(controller): decode old object for delete requests

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* chore: modernize golang

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* chore: modernize golang

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* chore: modernize golang

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* fix: preserve ca-bundles injected from external providers

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add metadata enforcement

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add metadata enforcement

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: add resourcepoolclaim validation

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: add resourcepoolclaim validation

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: add resourcepoolclaim validation

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* fix: add resourcepoolclaim validation

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

---------

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

pkg/runtime/events/reasons.go

@@ -8,11 +8,14 @@ const (
 	ReasonTenantResourceWriteOp string = "TenantResourceWriteOp"
 	ReasonOverprovision         string = "Overprovisioned"
 	ReasonCordoning             string = "Cordoned"
+
 	// ForbiddenLabelReason used as reason string to deny forbidden labels.
 	ReasonForbiddenLabel string = "ForbiddenLabel"
 	// ForbiddenAnnotationReason used as reason string to deny forbidden annotations.
 	ReasonForbiddenAnnotation string = "ForbiddenAnnotation"
-	ReasonAdmissionFailure    string = "AdmissionFailed"
+	ReasonForbiddenMetadata   string = "ForbiddenMetadata"
+
+	ReasonAdmissionFailure string = "AdmissionFailed"
 
 	// RuleStatus.
 	ReasonNamespaceRuleAudit string = "NamespaceRuleAudit"

pkg/runtime/gvk/gk_types.go

@@ -1,25 +0,0 @@
-// Copyright 2020-2026 Project Capsule Authors
-// SPDX-License-Identifier: Apache-2.0
-
-package gvk
-
-import "k8s.io/apimachinery/pkg/runtime/schema"
-
-type VersionKind struct {
-	// Kind of the referent.
-	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-	Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"`
-	// API version of the referent.
-	APIVersion string `json:"apiVersion" protobuf:"bytes,5,opt,name=apiVersion"`
-}
-
-func (s VersionKind) GroupVersionKind() schema.GroupVersionKind {
-	gv, err := schema.ParseGroupVersion(s.APIVersion)
-	if err != nil {
-		return schema.GroupVersionKind{
-			Kind: s.Kind,
-		}
-	}
-
-	return gv.WithKind(s.Kind)
-}