Add validating admission policy

[linglingye001]

No description provided.

[Copilot]

Pull request overview

This PR introduces a Kubernetes ValidatingAdmissionPolicy (and binding) to enforce that users creating/updating AzureAppConfigurationProvider resources are authorized to reference the specified ServiceAccount names (Workload Identity / Key Vault cases). It adds both a Helm-rendered version and a kustomize-ready manifest, plus an envtest that validates the authorization behavior.

Changes:

• Add a Helm template for a ValidatingAdmissionPolicy + ValidatingAdmissionPolicyBinding, gated behind workloadIdentity.enabled and serviceAccountAuthorization.enabled, with a Kubernetes version check (>= 1.30).
• Add new Helm values to configure serviceAccountAuthorization (including validationActions).
• Add kustomize admission manifests and an envtest validating allowed/forbidden behavior based on RBAC grants.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
deploy/templates/validatingadmissionpolicy.yaml	Helm template for the validating admission policy + binding, with K8s version gating.
deploy/parameter/helm-values.yaml	Adds chart values for enabling/configuring service account authorization actions.
config/admission/validatingadmissionpolicy.yaml	Static admission policy + binding manifest for kustomize/application outside Helm.
config/admission/validatingadmissionpolicy_test.go	Envtest coverage to validate admission behavior using impersonation + RBAC rules.
config/admission/kustomizeconfig.yaml	Kustomize nameReference wiring for binding → policy name.
config/admission/kustomization.yaml	Kustomize entrypoint for the admission policy resources.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

Makefile:143

• The Helm path guards this resource with a Kubernetes >=1.30 check, but make deploy applies it unconditionally. On a pre-1.30 cluster the controller resources are applied first and this command then fails because the ValidatingAdmissionPolicy API is unavailable, leaving a partial deployment and a failed target. Gate this apply on API/version availability or provide a separate opt-in admission deployment.

	$(KUSTOMIZE) build config/admission | $(KUBECTL) apply -f -

Makefile:147

• On clusters without the ValidatingAdmissionPolicy API, this delete fails even with --ignore-not-found because discovery cannot map the resource kind. Since it runs before deletion of config/default, make undeploy stops and leaves the controller installed. Guard this deletion on API availability (or otherwise tolerate a missing mapping) so the base resources are always removed.

	$(KUSTOMIZE) build config/admission | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -