Add lien admission plugin

pkg/kubeapiserver/options/plugins.go

@@ -33,6 +33,7 @@ import (
 	"k8s.io/kubernetes/plugin/pkg/admission/extendedresourcetoleration"
 	"k8s.io/kubernetes/plugin/pkg/admission/gc"
 	"k8s.io/kubernetes/plugin/pkg/admission/imagepolicy"
+	"k8s.io/kubernetes/plugin/pkg/admission/lien"
 	"k8s.io/kubernetes/plugin/pkg/admission/limitranger"
 	"k8s.io/kubernetes/plugin/pkg/admission/namespace/autoprovision"
 	"k8s.io/kubernetes/plugin/pkg/admission/namespace/exists"
@@ -94,6 +95,7 @@ var AllOrderedPlugins = []string{
 	certsubjectrestriction.PluginName,       // CertificateSubjectRestriction
 	defaultingressclass.PluginName,          // DefaultIngressClass
 	denyserviceexternalips.PluginName,       // DenyServiceExternalIPs
+	lien.PluginName,                         // Lien
 
 	// new admission plugins should generally be inserted above here
 	// webhook, resourcequota, and deny plugins must go at the end
@@ -139,6 +141,7 @@ func RegisterAllAdmissionPlugins(plugins *admission.Plugins) {
 	certapproval.Register(plugins)
 	certsigning.Register(plugins)
 	certsubjectrestriction.Register(plugins)
+	lien.Register(plugins)
 }
 
 // DefaultOffAdmissionPlugins get admission plugins off by default for kube-apiserver.
@@ -162,6 +165,7 @@ func DefaultOffAdmissionPlugins() sets.String {
 		certsubjectrestriction.PluginName,       // CertificateSubjectRestriction
 		defaultingressclass.PluginName,          // DefaultIngressClass
 		podsecurity.PluginName,                  // PodSecurity
+		lien.PluginName,                         // Lien
 	)
 
 	return sets.NewString(AllOrderedPlugins...).Difference(defaultOnPlugins)

plugin/pkg/admission/lien/admission.go

@@ -0,0 +1,77 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package lien
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apiserver/pkg/admission"
+)
+
+// PluginName indicates name of admission plugin.
+const PluginName = "Lien"
+
+// Register registers a plugin
+func Register(plugins *admission.Plugins) {
+	plugins.Register(PluginName, func(config io.Reader) (admission.Interface, error) {
+		return NewLien(), nil
+	})
+}
+
+// lien is an implementation of admission.Interface which block deletion when lien is not empty.
+type lien struct{}
+
+var _ admission.ValidationInterface = lien{}
+
+// Validate makes an admission decision based on the request attributes.  It is NOT allowed to mutate.
+func (lien) Validate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) {
+	// Only Validate Delete request
+	if a.GetOperation() != admission.Delete {
+		return nil
+	}
+
+	objMeta, err := meta.Accessor(a.GetOldObject())
+	if err != nil {
+		return admission.NewForbidden(a, fmt.Errorf("failed to get object metadata: %v", err))
+	}
+	liens := objMeta.GetLiens()
+
+	// Return forbidden if liens is not empty
+	if len(liens) > 0 {
+		return admission.NewForbidden(a, fmt.Errorf("deletion not allowed by liens"))
+	}
+
+	return nil
+}
+
+// Handles returns true if this admission controller can handle the given operation
+// where operation can be one of CREATE, UPDATE, DELETE, or CONNECT
+func (lien) Handles(operation admission.Operation) bool {
+	if operation == admission.Delete {
+		return true
+	}
+
+	return false
+}
+
+// NewLien creates a new lien admission handler
+func NewLien() admission.Interface {
+	return new(lien)
+}