chore(kustomize): blocking replicated resources write ops by tenant owners

config/install.yaml

@@ -3112,6 +3112,35 @@ webhooks:
     - services
     scope: Namespaced
   sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: capsule-webhook-service
+      namespace: capsule-system
+      path: /tenantresource-objects
+  failurePolicy: Fail
+  name: resource-objects.tenant.capsule.clastix.io
+  namespaceSelector:
+    matchExpressions:
+    - key: capsule.clastix.io/tenant
+      operator: Exists
+  objectSelector:
+    matchExpressions:
+    - key: capsule.clastix.io/resources
+      operator: Exists
+  rules:
+  - apiGroups:
+    - '*'
+    apiVersions:
+    - '*'
+    operations:
+    - UPDATE
+    - DELETE
+    resources:
+    - '*'
+    scope: Namespaced
+  sideEffects: None
 - admissionReviewVersions:
   - v1
   clientConfig:

config/webhook/manifests.yaml

@@ -253,6 +253,26 @@ webhooks:
     resources:
     - services
   sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /tenantresource-objects
+  failurePolicy: Fail
+  name: resource-objects.tenant.capsule.clastix.io
+  rules:
+  - apiGroups:
+    - '*'
+    apiVersions:
+    - '*'
+    operations:
+    - UPDATE
+    - DELETE
+    resources:
+    - '*'
+  sideEffects: None
 - admissionReviewVersions:
   - v1
   clientConfig:

config/webhook/patch_validating_ns_selector.yaml

@@ -40,6 +40,18 @@
     matchExpressions:
       - key: capsule.clastix.io/tenant
         operator: Exists
+- op: add
+  path: /webhooks/8/namespaceSelector
+  value:
+    matchExpressions:
+      - key: capsule.clastix.io/tenant
+        operator: Exists
+- op: add
+  path: /webhooks/8/objectSelector
+  value:
+    matchExpressions:
+      - key: capsule.clastix.io/resources
+        operator: Exists
 - op: add
   path: /webhooks/0/rules/0/scope
   value: Namespaced
@@ -58,3 +70,6 @@
 - op: add
   path: /webhooks/7/rules/0/scope
   value: Namespaced
+- op: add
+  path: /webhooks/8/rules/0/scope
+  value: Namespaced