Remove importance of order of rule in RestoreSession (#795)

Tasks:
- [x] Remove importance of rule order
- [x] Add validator to ensure followings,
	- [x] There is at most one rule with empty targetHosts field.
	- [x] No two rule with non-empty targetHosts matches for a host.
	- [x] If snapshot is specified in a rule then paths is not specified.
- [x] Update concept doc to make rules behavior clear

Fixes: stashed/stash#790

Author: hossainemruz

chart/stash/templates/apiregistration.yaml

@@ -22,6 +22,22 @@ spec:
 ---
 apiVersion: apiregistration.k8s.io/v1beta1
 kind: APIService
+metadata:
+  name: v1beta1.admission.stash.appscode.com
+  labels:
+    {{- include "stash.labels" . | nindent 4 }}
+spec:
+  group: admission.stash.appscode.com
+  version: v1beta1
+  service:
+    namespace: {{ .Release.Namespace }}
+    name: {{ template "stash.fullname" . }}
+  caBundle: {{ b64enc $ca.Cert }}
+  groupPriorityMinimum: {{ .Values.apiserver.groupPriorityMinimum }}
+  versionPriority: {{ .Values.apiserver.versionPriority }}
+---
+apiVersion: apiregistration.k8s.io/v1beta1
+kind: APIService
 metadata:
   name: v1alpha1.repositories.stash.appscode.com
   labels:

chart/stash/templates/validating-webhook.yaml

@@ -75,4 +75,25 @@ webhooks:
 {{- if and (ge $major 1) (ge $minor 12) }}
   sideEffects: None
 {{- end }}
+- name: restoresession.admission.stash.appscode.com
+  clientConfig:
+    service:
+      namespace: default
+      name: kubernetes
+      path: /apis/admission.stash.appscode.com/v1beta1/restoresessionvalidators
+    caBundle: {{ b64enc .Values.apiserver.ca }}
+  rules:
+  - operations:
+    - CREATE
+    - UPDATE
+    apiGroups:
+    - stash.appscode.com
+    apiVersions:
+    - "*"
+    resources:
+    - restoresessions
+  failurePolicy: Fail
+{{- if and (ge $major 1) (ge $minor 12) }}
+  sideEffects: None
+{{- end }}
 {{ end }}

deploy/apiservices.yaml

@@ -18,6 +18,23 @@ spec:
 # register as aggregated apiserver
 apiVersion: apiregistration.k8s.io/v1beta1
 kind: APIService
+metadata:
+  name: v1beta1.admission.stash.appscode.com
+  labels:
+    app: stash
+spec:
+  caBundle: ${SERVICE_SERVING_CERT_CA}
+  group: admission.stash.appscode.com
+  groupPriorityMinimum: 1000
+  versionPriority: 15
+  service:
+    name: stash-operator
+    namespace: ${STASH_NAMESPACE}
+  version: v1beta1
+---
+# register as aggregated apiserver
+apiVersion: apiregistration.k8s.io/v1beta1
+kind: APIService
 metadata:
   name: v1alpha1.repositories.stash.appscode.com
   labels:

deploy/stash.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 set -eou pipefail
 
-crds=(restics repositories recoveries backupconfigurations backupsessions)
+crds=(restics repositories recoveries backupconfigurations backupsessions backupconfigurationtemplates functions restoresessions tasks)
 
 echo "checking kubeconfig context"
 kubectl config current-context || {

deploy/validating-webhook.yaml

@@ -62,3 +62,22 @@ webhooks:
     - repositories
   failurePolicy: Fail
   ${STASH_WEBHOOK_SIDE_EFFECTS}
+- name: restoresession.admission.stash.appscode.com
+  clientConfig:
+    service:
+      namespace: default
+      name: kubernetes
+      path: /apis/admission.stash.appscode.com/v1beta1/restoresessionvalidators
+    caBundle: ${KUBE_CA}
+  rules:
+  - operations:
+    - CREATE
+    - UPDATE
+    apiGroups:
+    - stash.appscode.com
+    apiVersions:
+    - "*"
+    resources:
+    - restoresessions
+  failurePolicy: Fail
+  ${STASH_WEBHOOK_SIDE_EFFECTS}