add: DeletionProtection mechanism reject namespace deletion when PVCs…

… are included under namespace (#1228)

Signed-off-by: kevin1689 <[email protected]>

pkg/webhook/util/deletionprotection/deletion_protection.go

@@ -71,6 +71,18 @@ func ValidateNamespaceDeletion(c client.Client, namespace *v1.Namespace) error {
 		if activeCount > 0 {
 			return fmt.Errorf("forbidden by ResourcesProtectionDeletion for %s=%s and active pods %d>0", policyv1alpha1.DeletionProtectionKey, val, activeCount)
 		}
+
+		pvc := v1.PersistentVolumeClaimList{}
+		if err := c.List(context.TODO(), &pvc, client.InNamespace(namespace.Name)); err != nil {
+			return fmt.Errorf("forbidden by ResourcesProtectionDeletion for list pvc error: %v", err)
+		}
+		var pvcCount int
+		for range pvc.Items {
+			pvcCount++
+		}
+		if pvcCount > 0 {
+			return fmt.Errorf("forbidden by ResourcesProtectionDeletion for %s=%s and existing pvc %d>0", policyv1alpha1.DeletionProtectionKey, val, pvcCount)
+		}
 	default:
 	}
 	return nil