Add policy support for DELETE operations

[chandrasekharmalladi]

Summary

This change extends the core Rego library to support safely handling input.review.oldObject, and input.review.operation.

Details

• Updates resource to use:

  • input.review.object if present
  • fallback to input.review.oldObject in case of DELETE operations.

• Adds logic to expose core.operation using:

  • input.review.operation for Gatekeeper

Why

Gatekeeper policies for DELETE operations often need access to:

• The previous state (review.oldObject) - Gatekeeper input structure reference

• The operation type (review.operation)

Example Use Case

A policy can now safely evaluate:

core.kind == "Namespace"
core.operation == "DELETE"

[jalseth]

Thanks for the PR, but I have concerns about the impact. This has a high likelihood to break people's workflows if they are already using konstraint and don't care about DELETE operations. With this change, it would actually prevent people from deleting resources that violate policy.

[chandrasekharmalladi]

Hey @jalseth, apologies for getting back late. Thank you for reviewing the MR. I see what you mean, I tested it and it indeed blocks people from deleting resources that violate the policy.

The workarounds I can think of would need all the "non-delete" examples to explicitly define the operation.

Are there any other ways you could recommend to solve this problem? I am trying to have some OPA policies to block deletion of some key resources.