Implement mustnothave mode for OperatorPolicy

Enforced mustnohave policies will delete things based on the new
RemovalBehavior field. In inform mode, resources that would be removed
by an enforced policy will be causes for NonCompliance. This gives
control to users in order to prevent unintended side effects.

Refs:
 - https://issues.redhat.com/browse/ACM-9287

Signed-off-by: Justin Kulikauskas <jkulikau@redhat.com>

api/v1beta1/operatorpolicy_types.go

@@ -4,6 +4,8 @@
 package v1beta1
 
 import (
+	"strings"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 
@@ -15,7 +17,6 @@ import (
 type StatusConfigAction string
 
 // RemovalAction : Keep, Delete, or DeleteIfUnused
-// +kubebuilder:validation:Enum=Keep;Delete;DeleteIfUnused
 type RemovalAction string
 
 const (
@@ -36,20 +37,75 @@ const (
 	DeleteIfUnused RemovalAction = "DeleteIfUnused"
 )
 
-// RemovalBehavior defines resource behavior when policy is removed
+func (ra RemovalAction) IsKeep() bool {
+	return strings.EqualFold(string(ra), string(Keep))
+}
+
+func (ra RemovalAction) IsDelete() bool {
+	return strings.EqualFold(string(ra), string(Delete))
+}
+
+func (ra RemovalAction) IsDeleteIfUnused() bool {
+	return strings.EqualFold(string(ra), string(DeleteIfUnused))
+}
+
 type RemovalBehavior struct {
-	// Kind OperatorGroup
+	//+kubebuilder:default=DeleteIfUnused
+	//+kubebuilder:validation:Enum=Keep;Delete;DeleteIfUnused
+	// Specifies whether to delete the OperatorGroup; defaults to 'DeleteIfUnused' which
+	// will only delete the OperatorGroup if there is not another Subscription using it.
 	OperatorGroups RemovalAction `json:"operatorGroups,omitempty"`
-	// Kind Subscription
+
+	//+kubebuilder:default=Delete
+	//+kubebuilder:validation:Enum=Keep;Delete
+	// Specifies whether to delete the Subscription; defaults to 'Delete'
 	Subscriptions RemovalAction `json:"subscriptions,omitempty"`
-	// Kind ClusterServiceVersion
+
+	//+kubebuilder:default=Delete
+	//+kubebuilder:validation:Enum=Keep;Delete
+	// Specifies whether to delete the ClusterServiceVersion; defaults to 'Delete'
 	CSVs RemovalAction `json:"clusterServiceVersions,omitempty"`
-	// Kind InstallPlan
+
+	//+kubebuilder:default=Keep
+	//+kubebuilder:validation:Enum=Keep;Delete
+	// Specifies whether to delete any InstallPlans associated with the operator; defaults
+	// to 'Keep' because those objects are only for history
 	InstallPlan RemovalAction `json:"installPlans,omitempty"`
-	// Kind CustomResourceDefinitions
+
+	//+kubebuilder:default=Keep
+	//+kubebuilder:validation:Enum=Keep;Delete
+	// Specifies whether to delete any CustomResourceDefinitions associated with the operator;
+	// defaults to 'Keep' because deleting them should be done deliberately
 	CRDs RemovalAction `json:"customResourceDefinitions,omitempty"`
-	// Kind APIServiceDefinitions
-	APIServiceDefinitions RemovalAction `json:"apiServiceDefinitions,omitempty"`
+}
+
+// ApplyDefaults ensures that unset fields in a RemovalBehavior behave as if they were
+// set to the default values. In a cluster, kubernetes API validation should ensure that
+// there are no unset values, and should apply the default values itself.
+func (rb RemovalBehavior) ApplyDefaults() RemovalBehavior {
+	withDefaults := *rb.DeepCopy()
+
+	if withDefaults.OperatorGroups == "" {
+		withDefaults.OperatorGroups = DeleteIfUnused
+	}
+
+	if withDefaults.Subscriptions == "" {
+		withDefaults.Subscriptions = Delete
+	}
+
+	if withDefaults.CSVs == "" {
+		withDefaults.CSVs = Delete
+	}
+
+	if withDefaults.InstallPlan == "" {
+		withDefaults.InstallPlan = Keep
+	}
+
+	if withDefaults.CRDs == "" {
+		withDefaults.CRDs = Keep
+	}
+
+	return withDefaults
 }
 
 // StatusConfig defines how resource statuses affect the OperatorPolicy status and compliance
@@ -64,7 +120,7 @@ type StatusConfig struct {
 type OperatorPolicySpec struct {
 	Severity          policyv1.Severity          `json:"severity,omitempty"`          // low, medium, high
 	RemediationAction policyv1.RemediationAction `json:"remediationAction,omitempty"` // inform, enforce
-	ComplianceType    policyv1.ComplianceType    `json:"complianceType"`              // musthave
+	ComplianceType    policyv1.ComplianceType    `json:"complianceType"`              // musthave, mustnothave
 
 	// Include the name, namespace, and any `spec` fields for the OperatorGroup.
 	// For more info, see `kubectl explain operatorgroup.spec` or
@@ -84,11 +140,11 @@ type OperatorPolicySpec struct {
 	// in 'inform' mode, and which installPlans are approved when in 'enforce' mode
 	Versions []policyv1.NonEmptyString `json:"versions,omitempty"`
 
-	// FUTURE
-	//nolint:dupword
-	// RemovalBehavior RemovalBehavior           `json:"removalBehavior,omitempty"`
-	//nolint:dupword
-	// StatusConfig    StatusConfig              `json:"statusConfig,omitempty"`
+	//+kubebuilder:default={}
+	// RemovalBehavior defines what resources will be removed by enforced mustnothave policies.
+	// When in inform mode, any resources that would be deleted if the policy was enforced will
+	// be causes for NonCompliance, but resources that would be kept will be considered Compliant.
+	RemovalBehavior RemovalBehavior `json:"removalBehavior,omitempty"`
 }
 
 // OperatorPolicyStatus defines the observed state of OperatorPolicy