800cbfa870
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da
27 lines
1,015 B
YAML
27 lines
1,015 B
YAML
# CUST-WP-0073-T03: Secret annotation guard; manual ArgoCD sync.
|
|
# Owner: railiance-platform. Clean existing annotations in an attended session
|
|
# before binding; otherwise subsequent updates to those Secrets are rejected.
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingAdmissionPolicy
|
|
metadata:
|
|
name: reject-secret-last-applied
|
|
spec:
|
|
failurePolicy: Fail
|
|
matchConstraints:
|
|
resourceRules:
|
|
- apiGroups: [""]
|
|
apiVersions: ["v1"]
|
|
operations: ["CREATE", "UPDATE"]
|
|
resources: ["secrets"]
|
|
scope: "*"
|
|
validations:
|
|
- expression: '!has(object.metadata.annotations) || !("kubectl.kubernetes.io/last-applied-configuration" in object.metadata.annotations)'
|
|
message: "Secret last-applied annotations are forbidden; use server-side apply or replace."
|
|
---
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingAdmissionPolicyBinding
|
|
metadata:
|
|
name: reject-secret-last-applied
|
|
spec:
|
|
policyName: reject-secret-last-applied
|
|
validationActions: [Deny]
|