<p>I have put delete restrictions ( using validation webhook ) for all service accounts on a namespace , including the namespace itself , is there a way, as a cluster admin, I can delete objects from that namsepace? </p>

<pre><code>package kubernetes.admission

deny[msg] {
    namespace := input.request.namespace
    operation := input.request.operation
    namespaces := {"test01"}
    operations := {"CREATE","DELETE","UPDATE"}
    namespaces[namespace]
    operations[operation]

    msg := sprintf("Operation not permitted in protected namespace, invalid operation for %q",[namespace,operation])
}
</code></pre>

<p>Or , is there a way to put the cluster admin in exception.</p>

<p><strong>Update:</strong></p>

<p>I figured out the usernames to put in execption but this policy although evaluates correctly in policy checker but not having status: ok in configmap status:</p>

<pre><code>package kubernetes.admission
deny[msg] {
    namespace := input.request.namespace
    operation := input.request.operation
    username := input.request.userInfo.username
    namespaces := {"test01","kube-system"}
    users := {"kubernetes-admin","admin"}
    operations := {"CREATE","DELETE","UPDATE"}
    namespaces[namespace]
    operations[operation]
    not users[username]
    msg := sprintf("Operation not permitted in protected namespace, invalid operation for %q",[namespace,username,operation])
}
</code></pre>

<p><strong>Update:</strong></p>

<p>The policy status is Ok after a while.</p>

Ijaz Ahmad
<p>This policy works , given that the user-names are correct.</p>

<pre><code>package kubernetes.admission
    deny[msg] {
        namespace := input.request.namespace
        operation := input.request.operation
        username := input.request.userInfo.username
        namespaces := {"test01","kube-system"}
        users := {"kubernetes-admin","admin"}
        operations := {"CREATE","DELETE","UPDATE"}
        namespaces[namespace]
        operations[operation]
        not users[username]
        msg := sprintf("Operation not permitted in protected namespace, invalid operation for %q",[namespace,username,operation])
    }
</code></pre>
