# CUST-WP-0073-T03: Secret annotation guard; manual ArgoCD sync.
# Owner: railiance-platform. Clean existing annotations in an attended session
# before binding; otherwise subsequent updates to those Secrets are rejected.
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: reject-secret-last-applied
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["secrets"]
        scope: "*"
  validations:
    - expression: '!has(object.metadata.annotations) || !("kubectl.kubernetes.io/last-applied-configuration" in object.metadata.annotations)'
      message: "Secret last-applied annotations are forbidden; use server-side apply or replace."
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: reject-secret-last-applied
spec:
  policyName: reject-secret-last-applied
  validationActions: [Deny]