Automatically set the appGUID label on CFApp records about korifi HOT 5 CLOSED

One alternative to explore: can we only handle creation and then make the label immutable?

The Default() method does not know whether a resource is being created or updated, and there is no way to raise an error, so we chose to always set the appGuid label to the value of the metadata.name field. There does not appear to be a way to make a set of labels immutable.

from korifi.

It seems likely that we'll need https://github.com/open-policy-agent/gatekeeper, or similar, to disallow changes to parts of some resources based on role.

If you find you need immutable labels, that should be simple enough to set up as an OPA rule.

from korifi.

Yes, labels are not immutable and are not expected to be.

Should the sample resource have the label now deleted since the mutating webhook now creates it?

Otherwise everything looks good to me.

from korifi.

@angelachin Thats a good catch. Have addressed it in this PR

from korifi.

Awesome, looks good to me. Seems like this issue can be closed out.

from korifi.