MustNotHave mode for OperatorPolicy

api/v1beta1/operatorpolicy_types.go

@@ -4,6 +4,8 @@
 package v1beta1
 
 import (
+	"strings"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 
@@ -15,7 +17,6 @@ import (
 type StatusConfigAction string
 
 // RemovalAction : Keep, Delete, or DeleteIfUnused
-// +kubebuilder:validation:Enum=Keep;Delete;DeleteIfUnused
 type RemovalAction string
 
 const (
@@ -36,20 +37,75 @@ const (
 	DeleteIfUnused RemovalAction = "DeleteIfUnused"
 )
 
-// RemovalBehavior defines resource behavior when policy is removed
+func (ra RemovalAction) IsKeep() bool {
+	return strings.EqualFold(string(ra), string(Keep))
+}
+
+func (ra RemovalAction) IsDelete() bool {
+	return strings.EqualFold(string(ra), string(Delete))
+}
+
+func (ra RemovalAction) IsDeleteIfUnused() bool {
+	return strings.EqualFold(string(ra), string(DeleteIfUnused))
+}
+
 type RemovalBehavior struct {
-	// Kind OperatorGroup
+	//+kubebuilder:default=DeleteIfUnused
+	//+kubebuilder:validation:Enum=Keep;Delete;DeleteIfUnused
+	// Specifies whether to delete the OperatorGroup; defaults to 'DeleteIfUnused' which
+	// will only delete the OperatorGroup if there is not another Subscription using it.
 	OperatorGroups RemovalAction `json:"operatorGroups,omitempty"`
-	// Kind Subscription
+
+	//+kubebuilder:default=Delete
+	//+kubebuilder:validation:Enum=Keep;Delete
+	// Specifies whether to delete the Subscription; defaults to 'Delete'
 	Subscriptions RemovalAction `json:"subscriptions,omitempty"`
-	// Kind ClusterServiceVersion
+
+	//+kubebuilder:default=Delete
+	//+kubebuilder:validation:Enum=Keep;Delete
+	// Specifies whether to delete the ClusterServiceVersion; defaults to 'Delete'
 	CSVs RemovalAction `json:"clusterServiceVersions,omitempty"`
-	// Kind InstallPlan
+
+	//+kubebuilder:default=Keep
+	//+kubebuilder:validation:Enum=Keep;Delete
+	// Specifies whether to delete any InstallPlans associated with the operator; defaults
+	// to 'Keep' because those objects are only for history
 	InstallPlan RemovalAction `json:"installPlans,omitempty"`
-	// Kind CustomResourceDefinitions
+
+	//+kubebuilder:default=Keep
+	//+kubebuilder:validation:Enum=Keep;Delete
+	// Specifies whether to delete any CustomResourceDefinitions associated with the operator;
+	// defaults to 'Keep' because deleting them should be done deliberately
 	CRDs RemovalAction `json:"customResourceDefinitions,omitempty"`
-	// Kind APIServiceDefinitions
-	APIServiceDefinitions RemovalAction `json:"apiServiceDefinitions,omitempty"`
+}
+
+// ApplyDefaults ensures that unset fields in a RemovalBehavior behave as if they were
+// set to the default values. In a cluster, kubernetes API validation should ensure that
+// there are no unset values, and should apply the default values itself.
+func (rb RemovalBehavior) ApplyDefaults() RemovalBehavior {
+	withDefaults := *rb.DeepCopy()
+
+	if withDefaults.OperatorGroups == "" {
+		withDefaults.OperatorGroups = DeleteIfUnused
+	}
+
+	if withDefaults.Subscriptions == "" {
+		withDefaults.Subscriptions = Delete
+	}
+
+	if withDefaults.CSVs == "" {
+		withDefaults.CSVs = Delete
+	}
+
+	if withDefaults.InstallPlan == "" {
+		withDefaults.InstallPlan = Keep
+	}
+
+	if withDefaults.CRDs == "" {
+		withDefaults.CRDs = Keep
+	}
+
+	return withDefaults
 }
 
 // StatusConfig defines how resource statuses affect the OperatorPolicy status and compliance
@@ -64,7 +120,7 @@ type StatusConfig struct {
 type OperatorPolicySpec struct {
 	Severity          policyv1.Severity          `json:"severity,omitempty"`          // low, medium, high
 	RemediationAction policyv1.RemediationAction `json:"remediationAction,omitempty"` // inform, enforce
-	ComplianceType    policyv1.ComplianceType    `json:"complianceType"`              // musthave
+	ComplianceType    policyv1.ComplianceType    `json:"complianceType"`              // musthave, mustnothave
 
 	// Include the name, namespace, and any `spec` fields for the OperatorGroup.
 	// For more info, see `kubectl explain operatorgroup.spec` or
@@ -84,11 +140,11 @@ type OperatorPolicySpec struct {
 	// in 'inform' mode, and which installPlans are approved when in 'enforce' mode
 	Versions []policyv1.NonEmptyString `json:"versions,omitempty"`
 
-	// FUTURE
-	//nolint:dupword
-	// RemovalBehavior RemovalBehavior           `json:"removalBehavior,omitempty"`
-	//nolint:dupword
-	// StatusConfig    StatusConfig              `json:"statusConfig,omitempty"`
+	//+kubebuilder:default={}
+	// RemovalBehavior defines what resources will be removed by enforced mustnothave policies.
+	// When in inform mode, any resources that would be deleted if the policy was enforced will
+	// be causes for NonCompliance, but resources that would be kept will be considered Compliant.
+	RemovalBehavior RemovalBehavior `json:"removalBehavior,omitempty"`
 }
 
 // OperatorPolicyStatus defines the observed state of OperatorPolicy