Merge pull request kubernetes-retired#126 from rahulii/feature-block-changes

Protect all labels and annotations on propagated objects

Author: k8s-ci-robot

internal/objects/validator.go

@@ -281,6 +281,12 @@ func (v *Validator) handleInherited(ctx context.Context, op k8sadm.Operation, ne
 				"Cannot modify object propagated from namespace \""+oldSource+"\"")
 		}
 
+		// Check for all the labels and annotations (including HNC and non HNC)
+		if !reflect.DeepEqual(oldInst.GetLabels(), inst.GetLabels()) || !reflect.DeepEqual(oldInst.GetAnnotations(), inst.GetAnnotations()) {
+			return webhooks.Deny(metav1.StatusReasonForbidden,
+				"Cannot modify object propagated from namespace \""+oldSource+"\"")
+		}
+
 		return webhooks.Allow("no illegal updates to propagated object")
 	}
 

internal/objects/validator_test.go

@@ -210,6 +210,60 @@ func TestUserChanges(t *testing.T) {
 				},
 			},
 		},
+	}, {
+		name: "Deny changes to HNC annotations in propagated objects",
+		fail: true,
+		oldInst: &unstructured.Unstructured{
+			Object: map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "Pod",
+				"metadata": map[string]interface{}{
+					"labels": map[string]interface{}{
+						api.LabelInheritedFrom: "foo",
+					},
+				},
+			},
+		},
+		inst: &unstructured.Unstructured{
+			Object: map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "Pod",
+				"metadata": map[string]interface{}{
+					"labels": map[string]interface{}{
+						api.LabelInheritedFrom: "foo",
+					},
+					"annotations": map[string]interface{}{
+						api.AnnotationPropagatePrefix + "/select": "abc",
+					},
+				},
+			},
+		},
+	}, {
+		name: "Deny changes to HNC labels in propagated objects",
+		fail: true,
+		oldInst: &unstructured.Unstructured{
+			Object: map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "Pod",
+				"metadata": map[string]interface{}{
+					"labels": map[string]interface{}{
+						api.LabelInheritedFrom: "foo",
+					},
+				},
+			},
+		},
+		inst: &unstructured.Unstructured{
+			Object: map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "Pod",
+				"metadata": map[string]interface{}{
+					"labels": map[string]interface{}{
+						api.LabelInheritedFrom: "foo",
+						api.MetaGroup + "/foo": "foo",
+					},
+				},
+			},
+		},
 	}, {
 		name: "Deny spec changes to propagated objects",
 		fail: true,