feat: add resource protection webhook (#2168)

Signed-off-by: hongming <coder.scala@gmail.com>

pkg/constants/constants.go

@@ -8,6 +8,7 @@ package constants
 import corev1 "k8s.io/api/core/v1"
 
 const (
+	SystemWorkspace            = "system-workspace"
 	KubeSystemNamespace        = "kube-system"
 	KubeSphereNamespace        = "kubesphere-system"
 	KubeSphereAPIServerName    = "ks-apiserver"
@@ -15,6 +16,7 @@ const (
 	KubeSphereConfigMapDataKey = "kubesphere.yaml"
 	KubectlPodNamePrefix       = "ks-managed-kubectl"
 
+	ProtectedResourceLabel        = "kubesphere.io/protected-resource"
 	WorkspaceLabelKey             = "kubesphere.io/workspace"
 	DisplayNameAnnotationKey      = "kubesphere.io/alias-name"
 	DescriptionAnnotationKey      = "kubesphere.io/description"

pkg/controller/resourceprotection/resource_protection_webhook.go

@@ -0,0 +1,56 @@
+package resourceprotection
+
+import (
+	"context"
+	"net/http"
+
+	admissionv1 "k8s.io/api/admission/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+
+	"kubesphere.io/kubesphere/pkg/constants"
+	kscontroller "kubesphere.io/kubesphere/pkg/controller"
+)
+
+const webhookName = "resource-protection-webhook"
+
+func (w *Webhook) Name() string {
+	return webhookName
+}
+
+type Webhook struct {
+	client.Client
+}
+
+func (w *Webhook) SetupWithManager(mgr *kscontroller.Manager) error {
+	w.Client = mgr.GetClient()
+	mgr.GetWebhookServer().Register("/resource-protector", &webhook.Admission{Handler: w})
+	return nil
+}
+
+func (w *Webhook) Handle(ctx context.Context, req admission.Request) admission.Response {
+	if req.Operation == admissionv1.Delete {
+		gvr := req.RequestResource
+		gvk, err := w.RESTMapper().KindFor(schema.GroupVersionResource{
+			Group:    gvr.Group,
+			Version:  gvr.Version,
+			Resource: gvr.Resource,
+		})
+		if err != nil {
+			return webhook.Errored(http.StatusInternalServerError, err)
+		}
+		obj := &unstructured.Unstructured{}
+		obj.SetGroupVersionKind(gvk)
+		if err = w.Get(ctx, client.ObjectKey{Namespace: req.Namespace, Name: req.Name}, obj); err != nil {
+			return webhook.Errored(http.StatusInternalServerError, err)
+		}
+
+		if obj.GetLabels()[constants.ProtectedResourceLabel] == "true" {
+			return webhook.Denied("this resource may not be deleted")
+		}
+	}
+	return admission.Allowed("")
+}