Support DELETE operations

[ritazh]

after updating the validation webhook config,

- apiGroups:
  - '*'
  apiVersions:
  - '*'
  operations:
  - CREATE
  - UPDATE
  - DELETE
  resources:
  - '*'

webhook returned this error

Error from server (admission.k8s.gatekeeper.sh: HandleViolation:NestedMap: .object accessor error: <nil> is of the type <nil>, expected map[string]interface{}
): admission webhook "validation.gatekeeper.sh" denied the request: admission.k8s.gatekeeper.sh: HandleViolation:NestedMap: .object accessor error: <nil> is of the type <nil>, expected map[string]interface{}

It seems AdmissionRequest's object is nil when operation: DELETE

{"AdmissionRequest":{"uid":"bf47233e-9202-11e9-afd8-000d3a94fc72","kind":{"group":"","version":"v1","kind":"Namespace"},"resource":{"group":"","version":"v1","resource":"namespaces"},"name":"bad-prod-ns","namespace":"bad-prod-ns","operation":"DELETE","userInfo":{"username":"client","groups":["system:masters","system:authenticated"]},"object":null,"oldObject":null,"dryRun":false}}

[maxsmythe]

nil object may create problems for the TargetHandler... either its golang code, its Rego, or both. I recommend tracing through that logic for any issues.

[ritazh]

yea we can't evaluate correctly without input.review.object I'm still trying to figure out why AdmissionRequest object is null.

[maxsmythe]

object is the value of the resultant object, which for DELETE is nothing.

The original object is under oldObject

[ritazh]

both object and oldObject are null in AdmissionRequest

[ritazh]

Looks like this issue kubernetes/kubernetes#66536 was fixed by kubernetes/kubernetes#76346 in k8s v1.15

From 1.15 docs:

    // object is the new object being admitted.
    // It is null for DELETE operations.
    "object": {"apiVersion":"autoscaling/v1","kind":"Scale",...},
    // oldObject is the existing object.
    // It is null for CREATE and CONNECT operations (and for DELETE operations in API servers prior to v1.15.0)
    "oldObject": {"apiVersion":"autoscaling/v1","kind":"Scale",...},
    // options contains the options for the operation being admitted, like meta.k8s.io/v1 CreateOptions, UpdateOptions, or DeleteOptions.
    // It is null for CONNECT operations.
    // Only sent by v1.15+ API servers.
    "options": {"apiVersion":"meta.k8s.io/v1","kind":"UpdateOptions",...},

[maxsmythe]

nice, I like that they fixed that