Add delete validation to the webhook and ignore marshalling (kptdev#1114)

* Add delete validation to the webhook and ignore marshalling

Signed-off-by: Kushal Harish Naidu <kushal.harish.naidu@ericsson.com>

* Check for error during response write

Signed-off-by: Kushal Harish Naidu <kushal.harish.naidu@ericsson.com>

* Add unit test to cover repo delete validation

Signed-off-by: Kushal Harish Naidu <kushal.harish.naidu@ericsson.com>

---------

Signed-off-by: Kushal Harish Naidu <kushal.harish.naidu@ericsson.com>

Author: kushnaidu

pkg/apiserver/webhooks.go

@@ -291,6 +291,7 @@ func createValidatingWebhook(ctx context.Context, cfg *WebhookConfig, caCert []b
 				Operations: []admissionregistrationv1.OperationType{
 					admissionregistrationv1.Create,
 					admissionregistrationv1.Update,
+					admissionregistrationv1.Delete,
 				},
 				Rule: admissionregistrationv1.Rule{
 					APIGroups:   []string{configapi.GroupVersion.Group},
@@ -520,6 +521,31 @@ func validateRepository(w http.ResponseWriter, r *http.Request, clientReader cli
 		return
 	}
 
+	// For DELETE operations, Object.Raw is empty — the API server sends the object in OldObject.
+	// No conflict detection needed for deletes, just allow them through.
+	if admissionReviewRequest.Request.Operation == admissionv1.Delete {
+		klog.Infof("repository deletion validated for %s", repoName)
+		resp := &admissionv1.AdmissionResponse{
+			Allowed: true,
+			Result: &metav1.Status{
+				Status:  "Success",
+				Message: "Repository deletion validated successfully",
+			},
+		}
+		responseBytes, err := constructResponse(resp, admissionReviewRequest)
+		if err != nil {
+			writeErr(fmt.Sprintf("error constructing response: %v", err), &w)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, err = w.Write(responseBytes) // #nosec G705
+		if err != nil {
+			klog.Errorf("error writing response: %v", err)
+			return
+		}
+		return
+	}
+
 	var attempted configapi.Repository
 	if err := json.Unmarshal(admissionReviewRequest.Request.Object.Raw, &attempted); err != nil {
 		klog.Errorf("failed to unmarshal repository object: %v", err)

pkg/apiserver/webhooks_test.go

@@ -372,6 +372,40 @@ func TestValidateRepository(t *testing.T) {
 			response.Body.String())
 	})
 
+	t.Run("delete operation skips unmarshal and allows", func(t *testing.T) {
+		admissionReview := admissionv1.AdmissionReview{
+			TypeMeta: v1.TypeMeta{
+				Kind:       "AdmissionReview",
+				APIVersion: "admission.k8s.io/v1",
+			},
+			Request: &admissionv1.AdmissionRequest{
+				UID: "delete-123",
+				Resource: v1.GroupVersionResource{
+					Group:    "config.porch.kpt.dev",
+					Version:  "v1alpha1",
+					Resource: "repositories",
+				},
+				Operation: admissionv1.Delete,
+				Name:      "my-repo",
+				Namespace: "test-ns",
+				// Object.Raw is empty on DELETE — this is the scenario that was failing
+				OldObject: runtime.RawExtension{Raw: []byte(`{"metadata":{"name":"my-repo","namespace":"test-ns"}}`)},
+			},
+		}
+		body, err := json.Marshal(admissionReview)
+		require.NoError(t, err)
+
+		request, err := http.NewRequest(http.MethodPost, repositoryValidationEndpoint, bytes.NewReader(body))
+		require.NoError(t, err)
+		request.Header.Set("Content-Type", "application/json")
+
+		response := httptest.NewRecorder()
+		validateRepository(response, request, fakeClient)
+
+		require.Equal(t, http.StatusOK, response.Code)
+		require.Contains(t, response.Body.String(), "Repository deletion validated successfully")
+	})
+
 	createAdmissionReview := func(name, namespace, gitURL, directory, branch string) []byte {
 		repo := configapi.Repository{
 			ObjectMeta: v1.ObjectMeta{