Add policy support for DELETE operations

examples/container_deny_added_caps/template.yaml

@@ -22,11 +22,22 @@ spec:
         has_field(input.review, "object")
       }
 
+      is_gatekeeper if {
+        has_field(input, "review")
+        has_field(input.review, "oldObject")
+      }
+
       resource := input.review.object if {
         is_gatekeeper
+        has_field(input.review, "object")
+      }
+
+      else := input.review.oldObject if {
+        is_gatekeeper
+        has_field(input.review, "oldObject")
       }
 
-      resource := input if {
+      else := input if {
         not is_gatekeeper
       }
 
@@ -47,6 +58,12 @@ spec:
 
       annotations := resource.metadata.annotations
 
+      operation := input.review.operation if {
+        is_gatekeeper
+      } else := input.operation if {
+        not is_gatekeeper
+      }
+
       gv := split(apiVersion, "/")
 
       group := gv[0] if {

examples/container_deny_escalation/template.yaml

@@ -22,11 +22,22 @@ spec:
         has_field(input.review, "object")
       }
 
+      is_gatekeeper if {
+        has_field(input, "review")
+        has_field(input.review, "oldObject")
+      }
+
       resource := input.review.object if {
         is_gatekeeper
+        has_field(input.review, "object")
+      }
+
+      else := input.review.oldObject if {
+        is_gatekeeper
+        has_field(input.review, "oldObject")
       }
 
-      resource := input if {
+      else := input if {
         not is_gatekeeper
       }
 
@@ -47,6 +58,12 @@ spec:
 
       annotations := resource.metadata.annotations
 
+      operation := input.review.operation if {
+        is_gatekeeper
+      } else := input.operation if {
+        not is_gatekeeper
+      }
+
       gv := split(apiVersion, "/")
 
       group := gv[0] if {

examples/container_deny_latest_tag/template.yaml

@@ -22,11 +22,22 @@ spec:
         has_field(input.review, "object")
       }
 
+      is_gatekeeper if {
+        has_field(input, "review")
+        has_field(input.review, "oldObject")
+      }
+
       resource := input.review.object if {
         is_gatekeeper
+        has_field(input.review, "object")
+      }
+
+      else := input.review.oldObject if {
+        is_gatekeeper
+        has_field(input.review, "oldObject")
       }
 
-      resource := input if {
+      else := input if {
         not is_gatekeeper
       }
 
@@ -47,6 +58,12 @@ spec:
 
       annotations := resource.metadata.annotations
 
+      operation := input.review.operation if {
+        is_gatekeeper
+      } else := input.operation if {
+        not is_gatekeeper
+      }
+
       gv := split(apiVersion, "/")
 
       group := gv[0] if {

examples/container_deny_privileged/template.yaml

@@ -22,11 +22,22 @@ spec:
         has_field(input.review, "object")
       }
 
+      is_gatekeeper if {
+        has_field(input, "review")
+        has_field(input.review, "oldObject")
+      }
+
       resource := input.review.object if {
         is_gatekeeper
+        has_field(input.review, "object")
+      }
+
+      else := input.review.oldObject if {
+        is_gatekeeper
+        has_field(input.review, "oldObject")
       }
 
-      resource := input if {
+      else := input if {
         not is_gatekeeper
       }
 
@@ -47,6 +58,12 @@ spec:
 
       annotations := resource.metadata.annotations
 
+      operation := input.review.operation if {
+        is_gatekeeper
+      } else := input.operation if {
+        not is_gatekeeper
+      }
+
       gv := split(apiVersion, "/")
 
       group := gv[0] if {

examples/container_deny_privileged_if_tenant/template.yaml

@@ -22,11 +22,22 @@ spec:
         has_field(input.review, "object")
       }
 
+      is_gatekeeper if {
+        has_field(input, "review")
+        has_field(input.review, "oldObject")
+      }
+
       resource := input.review.object if {
         is_gatekeeper
+        has_field(input.review, "object")
+      }
+
+      else := input.review.oldObject if {
+        is_gatekeeper
+        has_field(input.review, "oldObject")
       }
 
-      resource := input if {
+      else := input if {
         not is_gatekeeper
       }
 
@@ -47,6 +58,12 @@ spec:
 
       annotations := resource.metadata.annotations
 
+      operation := input.review.operation if {
+        is_gatekeeper
+      } else := input.operation if {
+        not is_gatekeeper
+      }
+
       gv := split(apiVersion, "/")
 
       group := gv[0] if {

examples/container_deny_without_resource_constraints/template.yaml

@@ -22,11 +22,22 @@ spec:
         has_field(input.review, "object")
       }
 
+      is_gatekeeper if {
+        has_field(input, "review")
+        has_field(input.review, "oldObject")
+      }
+
       resource := input.review.object if {
         is_gatekeeper
+        has_field(input.review, "object")
+      }
+
+      else := input.review.oldObject if {
+        is_gatekeeper
+        has_field(input.review, "oldObject")
       }
 
-      resource := input if {
+      else := input if {
         not is_gatekeeper
       }
 
@@ -47,6 +58,12 @@ spec:
 
       annotations := resource.metadata.annotations
 
+      operation := input.review.operation if {
+        is_gatekeeper
+      } else := input.operation if {
+        not is_gatekeeper
+      }
+
       gv := split(apiVersion, "/")
 
       group := gv[0] if {

examples/lib/core.rego

@@ -9,11 +9,22 @@ is_gatekeeper if {
 	has_field(input.review, "object")
 }
 
+is_gatekeeper if {
+	has_field(input, "review")
+	has_field(input.review, "oldObject")
+}
+
 resource := input.review.object if {
 	is_gatekeeper
+	has_field(input.review, "object")
+}
+
+else := input.review.oldObject if {
+	is_gatekeeper
+	has_field(input.review, "oldObject")
 }
 
-resource := input if {
+else := input if {
 	not is_gatekeeper
 }
 
@@ -34,6 +45,12 @@ labels := resource.metadata.labels
 
 annotations := resource.metadata.annotations
 
+operation := input.review.operation if {
+	is_gatekeeper
+} else := input.operation if {
+	not is_gatekeeper
+}
+
 gv := split(apiVersion, "/")
 
 group := gv[0] if {

examples/lib/core_test.rego

@@ -10,6 +10,10 @@ test_is_gk if {
 	is_gatekeeper with input as {"review": {"object": {"kind": "test"}}}
 }
 
+test_is_gk_oldobject if {
+	is_gatekeeper with input as {"review": {"oldObject": {"kind": "test"}}}
+}
+
 test_has_field_pos if {
 	has_field({"kind": "test"}, "kind")
 }

examples/namespace_deny_deletion/constraint.yaml

@@ -0,0 +1,11 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: NamespaceDenyDeletion
+metadata:
+  name: namespacedenydeletion
+spec:
+  match:
+    kinds:
+    - apiGroups:
+      - ""
+      kinds:
+      - Namespace

examples/namespace_deny_deletion/src.rego

@@ -0,0 +1,31 @@
+# METADATA
+# title: Namespace deletion must be denied unless explicitly allowed
+# description: >-
+#   Prevent deletion of Kubernetes namespaces to avoid accidental or unauthorized removal of critical workloads.
+# custom:
+#   matchers:
+#     kinds:
+#     - apiGroups:
+#       - ""
+#       kinds:
+#       - Namespace
+package namespace_deny_delete
+
+import data.lib.core
+import future.keywords.contains
+import future.keywords.if
+import future.keywords.if
+
+policyID := "P2007"
+
+violation contains msg if {
+	core.kind == "Namespace"
+	core.operation == "DELETE"
+	not allow_namespace_deletion
+
+	msg := core.format_with_id(sprintf("%s/%s: Deletion of Namespace is not allowed", [core.kind, core.name]), policyID)
+}
+
+allow_namespace_deletion if {
+	core.annotations["allow-deletion"] == "true"
+}

examples/namespace_deny_deletion/src_test.rego

@@ -0,0 +1,25 @@
+package namespace_deny_delete
+
+import future.keywords.if
+
+test_deny_namespace_delete_without_annotation if {
+	not allow_namespace_deletion with input as {
+		"kind": "Namespace",
+		"metadata": {
+			"name": "my-ns",
+			"annotations": {},
+		},
+		"operation": "DELETE",
+	}
+}
+
+test_allow_namespace_delete_with_annotation if {
+	allow_namespace_deletion with input as {
+		"kind": "Namespace",
+		"metadata": {
+			"name": "safe-ns",
+			"annotations": {"allow-deletion": "true"},
+		},
+		"operation": "DELETE",
+	}
+}