Advance supervised agent records and close verified Secret annotation guard

docs/changes/CUST-WP-0073/reject-secret-last-applied.yaml

@@ -0,0 +1,27 @@
+# Prepared under CUST-WP-0073-T03; not installed.
+# Owner: railiance-platform. Clean existing annotations in an attended session
+# before binding; otherwise subsequent updates to those Secrets are rejected.
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: reject-secret-last-applied
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+      - apiGroups: [""]
+        apiVersions: ["v1"]
+        operations: ["CREATE", "UPDATE"]
+        resources: ["secrets"]
+        scope: "*"
+  validations:
+    - expression: '!has(object.metadata.annotations) || !("kubectl.kubernetes.io/last-applied-configuration" in object.metadata.annotations)'
+      message: "Secret last-applied annotations are forbidden; use server-side apply or replace."
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: reject-secret-last-applied
+spec:
+  policyName: reject-secret-last-applied
+  validationActions: [Deny]