20 lines
808 B
YAML
20 lines
808 B
YAML
|
# CUST-WP-0073-T03: Secret annotation guard; manual ArgoCD sync.
|
||
|
|
# Owner: railiance-platform. Clean existing annotations in an attended session
|
||
|
|
# before binding; otherwise subsequent updates to those Secrets are rejected.
|
||
|
|
apiVersion: admissionregistration.k8s.io/v1
|
||
|
|
kind: ValidatingAdmissionPolicy
|
||
|
|
metadata:
|
||
|
|
name: reject-secret-last-applied
|
||
|
|
spec:
|
||
|
|
failurePolicy: Fail
|
||
|
|
matchConstraints:
|
||
|
|
resourceRules:
|
||
|
|
- apiGroups: [""]
|
||
|
|
apiVersions: ["v1"]
|
||
|
|
operations: ["CREATE", "UPDATE"]
|
||
|
|
resources: ["secrets"]
|
||
|
|
scope: "*"
|
||
|
|
validations:
|
||
|
|
- expression: '!has(object.metadata.annotations) || !("kubectl.kubernetes.io/last-applied-configuration" in object.metadata.annotations)'
|
||
|
|
message: "Secret last-applied annotations are forbidden; use server-side apply or replace."
|