/namespace-delete-checker

Primary LanguageGoMIT LicenseMIT

Introduction

In K8s, when a namespace is deleted, pods and other resources that belong to this namespace will be deleted soon.

However, the namespace deleting operation may be a mistake.

This project is used to prevent important resources from being deleted.

How it works

  1. hook the namespace deleting operation by k8s webhook

  2. get resources in this namespace

  3. if something important exists,the delete operation will be rejected

How to use

  1. enable webhook by adding ValidatingAdmissionWebhook to kube-apiserver flag --admission-control
  2. get all resources, kubectl api-resources -namespaced=true
  3. modify the config.json to ignore the unimportant resources.
  4. deploy this project. using k8s Deployment and Service is recommended. ServiceAccount is also needed.
  5. the certs and caBundle can be generated by vault.
  6. get more in Makefile.
  7. have a try.