chore: add policy to prevent changing personal organization display name

Author: scotwells

config/default/kustomization.yaml

@@ -18,6 +18,7 @@ resources:
 #- ../crd
 - ../rbac
 - ../manager
+- ../policies
 # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
 # crd/kustomization.yaml
 #- ../webhook

config/policies/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+  - validation/

config/policies/validation/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+  - organization-update-policy.yaml

config/policies/validation/organization-update-policy.yaml

@@ -0,0 +1,15 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: "organization-update-policy.miloapis.com"
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:   ["resourcemanager.miloapis.com"]
+      apiVersions: ["v1alpha1"]
+      operations:  ["UPDATE"]
+      resources:   ["organizations"]
+  validations:
+  - expression: "object.spec.type != 'Personal' || oldObject.metadata.annotations.get('kubernetes.io/display-name', '') == object.metadata.annotations.get('kubernetes.io/display-name', '')"
+    message: "The display name of a personal organization cannot be changed."