feat: add CleanupPolicy validation code to CleanupPolicyHandler

[NikhilSharmaWe]

Signed-off-by: Nikhil Sharma nikhilsharma230303@gmail.com

Explanation

This PR add validation code for validating CleanupPolicies to CleanupPolicyHandler.

Validations added:

1. Check whether the policy name is valid or not.
2. Check whether the Schedule specified by the user is in proper cron format or not.
3. Validate the MatchResources and ExcludeResources.
4. Check if the resultant of match and exclude block is not an empty set.
5. Check whether the CleanupPolicy have permission to delete the matching resources.

[codecov]

Codecov Report

Merging #5338 (542de69) into main (c37e9d4) will decrease coverage by 0.04%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##             main    #5338      +/-   ##
==========================================
- Coverage   36.03%   35.98%   -0.05%     
==========================================
  Files         167      169       +2     
  Lines       18913    18938      +25     
==========================================
  Hits         6815     6815              
- Misses      11309    11334      +25     
  Partials      789      789              

Impacted Files	Coverage Δ
pkg/utils/admission/cleanup.go	0.00% <0.00%> (ø)
pkg/utils/admission/policy.go	0.00% <0.00%> (ø)
pkg/utils/admission/utils.go	0.00% <ø> (ø)

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[eddycharly]

Do we need the open api manager ?

[eddycharly]

This is a good start. Can you add a kuttl test, at least for simple cases ?

[eddycharly]

@NikhilSharmaWe it looks like we are not supporting namespaced policy ?

[NikhilSharmaWe]

@eddycharly We are using CleanupPolicyInterface, which includes both CleanupPolicy and ClusterCleanupPolicy.

[eddycharly]

@NikhilSharmaWe I mean in this code:

func UnmarshalCleanupPolicy(kind string, raw []byte) (kyvernov1alpha1.CleanupPolicyInterface, error) {
	var policy kyvernov1alpha1.CleanupPolicyInterface
	if kind == "CleanupPolicy" {
		if err := json.Unmarshal(raw, &policy); err != nil {
			return policy, err
		}
		return policy, nil
	}
	return policy, fmt.Errorf("admission request does not contain a cleanuppolicy")
}

How is this going to work with ClusterCleanupPolicy ?

[realshuting]

Why add openAPIManager? Do we need extra schema validation for cleanup policies?

[eddycharly]

Aren't we going to need it to validate the resource scope ?

[realshuting]

What metrics do we want to expose for cleanup policies?

[realshuting]

@NikhilSharmaWe - can you be more specific about what validations are added via this PR?