feat: reject workload creation via validating admission webhook when referenced WorkloadPolicy does not exist

[dottorblaster]

Currently, when a pod is created with the security.rancher.io/policy label referencing a WorkloadPolicy that doesn't exist, the pod is allowed to start and an error is logged (internal/nri/plugin.go:176-179). This means the pod runs without any runtime protection silently.

We should add a new VAP/validating admission webhook that checks, at pod CREATE time, whether the WorkloadPolicy referenced in the security.rancher.io/policy label actually exists in the cluster. If the policy does not exist, the pod creation should be denied with a clear error message.

This will work alongside a future NRI-level enforcement (see #392) that blocks container startup until the policy is reconciled by the agent.

Acceptance Criteria

• VAP rejects pod creation when the referenced WorkloadPolicy does not exist: When a pod is created with a security.rancher.io/policy label, the admission policy must verify that a WorkloadPolicy resource with that name exists in the same namespace. If it does not exist, the pod creation must be denied with a descriptive error message.
• Pods without the policy label are not affected: Pods that do not have the security.rancher.io/policy label must be admitted normally. The VAP must only apply to pods that explicitly reference a policy.
• E2E tests validate both allow and deny paths

[holyspectral]

Thanks for creating the ticket! Just to confirm do we want to do the check when pod creation or workload creation? Both are feasible for sure, but doing it at pod creation would not fail the GitOps deployment.

[dottorblaster]

Thanks for the question, I think workload creation would be better. 👍 Sorry but when I read VAP I immediately thought about a pure VAP, we might need a validating admission webhook instead.

[flavio]

I've spoken with Davide. We're fine introducing a dependency against Kubewarden Admission Controller.

I can take care of writing the policy

[flavio]

You can find a tutorial explaining how to create a policy in Go here.

The policy we have to build is a context aware policy. You will have to use these APIs.

You can find a go example here.