fix: add serviceaccount validation for tenantowners and tenants (#1966)

* fix(controller): decode old object for delete requests

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* chore: modernize golang

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* chore: modernize golang

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* chore: modernize golang

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* fix: preserve ca-bundles injected from external providers

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: add serviceaccount validation for tenantowners and tenants

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: add serviceaccount validation for tenantowners and tenants

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix(sec): add namespace termination interception

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix(sec): add namespace termination interception

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: correct sa check

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix(sec): add namespace termination interception

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

---------

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

cmd/controller/main.go

@@ -69,6 +69,7 @@ import (
 	namespacemutation "github.com/projectcapsule/capsule/internal/webhook/namespace/mutation"
 	namespacevalidation "github.com/projectcapsule/capsule/internal/webhook/namespace/validation"
 	"github.com/projectcapsule/capsule/internal/webhook/node"
+	"github.com/projectcapsule/capsule/internal/webhook/owners"
 	"github.com/projectcapsule/capsule/internal/webhook/pod"
 	"github.com/projectcapsule/capsule/internal/webhook/pvc"
 	"github.com/projectcapsule/capsule/internal/webhook/resourcepool"
@@ -611,13 +612,16 @@ func main() {
 				tenantvalidation.RuleHandler(),
 				tenantvalidation.HostnameRegexHandler(),
 				tenantvalidation.FreezedEmitter(),
-				tenantvalidation.ServiceAccountNameHandler(),
+				tenantvalidation.OwnersHandler(),
 				tenantvalidation.ForbiddenAnnotationsRegexHandler(),
 				tenantvalidation.ProtectedHandler(),
 				tenantvalidation.RequiredMetadataHandler(),
 				tenantvalidation.WarningHandler(cfg),
 			),
 		),
+		route.TenantOwnersValidation(
+			owners.UserMetadataHandler(),
+		),
 		route.NamespaceValidation(
 			namespacevalidation.NamespaceHandler(
 				cfg,
@@ -661,6 +665,7 @@ func main() {
 			cfgvalidation.Handler(cfg,
 				cfgvalidation.WarningHandler(),
 				cfgvalidation.ServiceAccountHandler(),
+				cfgvalidation.OwnerHandler(),
 			),
 		),
 	)