fix: support DELETE configs validation

pkg/webhook/policy.go

@@ -349,15 +349,15 @@ func (h *validationHandler) validateGatekeeperResources(ctx context.Context, req
 		if err := h.validateConfigResource(req); err != nil {
 			return true, err
 		}
-	case req.AdmissionRequest.Kind.Group == mutationsGroup && req.AdmissionRequest.Kind.Kind == "AssignMetadata":
+	case gvk.Group == mutationsGroup && gvk.Kind == "AssignMetadata":
 		return h.validateAssignMetadata(req)
-	case req.AdmissionRequest.Kind.Group == mutationsGroup && req.AdmissionRequest.Kind.Kind == "Assign":
+	case gvk.Group == mutationsGroup && gvk.Kind == "Assign":
 		return h.validateAssign(req)
-	case req.AdmissionRequest.Kind.Group == mutationsGroup && req.AdmissionRequest.Kind.Kind == "ModifySet":
+	case gvk.Group == mutationsGroup && gvk.Kind == "ModifySet":
 		return h.validateModifySet(req)
-	case req.AdmissionRequest.Kind.Group == mutationsGroup && req.AdmissionRequest.Kind.Kind == "AssignImage":
+	case gvk.Group == mutationsGroup && gvk.Kind == "AssignImage":
 		return h.validateAssignImage(req)
-	case req.AdmissionRequest.Kind.Group == externalDataGroup && req.AdmissionRequest.Kind.Kind == "Provider":
+	case gvk.Group == externalDataGroup && gvk.Kind == "Provider":
 		return h.validateProvider(req)
 	}
 
@@ -449,6 +449,10 @@ func (h *validationHandler) validateExpansionTemplate(req *admission.Request) (b
 }
 
 func (h *validationHandler) validateConfigResource(req *admission.Request) error {
+	if req.Operation == admissionv1.Delete && req.Name == "" {
+		return nil // Allow the general DELETE of "/apis/config.gatekeeper.sh/v1alpha1/namespaces/<ns>/configs"
+	}
+
 	if req.Name != keys.Config.Name {
 		return fmt.Errorf("config resource must have name 'config'")
 	}

pkg/webhook/policy_test.go

@@ -811,36 +811,50 @@ func TestGetValidationMessages(t *testing.T) {
 
 func TestValidateConfigResource(t *testing.T) {
 	tc := []struct {
-		TestName string
-		Name     string
-		Err      bool
+		name      string
+		rName     string
+		deleteOp  bool
+		expectErr bool
 	}{
 		{
-			TestName: "Wrong name",
-			Name:     "FooBar",
-			Err:      true,
+			name:      "Wrong name",
+			rName:     "FooBar",
+			expectErr: true,
 		},
 		{
-			TestName: "Correct name",
-			Name:     "config",
+			name:  "Correct name",
+			rName: "config",
+		},
+		{
+			name:     "Delete operation with no name",
+			deleteOp: true,
+		},
+		{
+			name:      "Delete operation with name",
+			deleteOp:  true,
+			rName:     "abc",
+			expectErr: true,
 		},
 	}
 
 	for _, tt := range tc {
-		t.Run(tt.TestName, func(t *testing.T) {
+		t.Run(tt.name, func(t *testing.T) {
 			handler := validationHandler{log: log}
 			req := &admission.Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
-					Name: tt.Name,
+					Name: tt.rName,
 				},
 			}
+			if tt.deleteOp {
+				req.AdmissionRequest.Operation = admissionv1.Delete
+			}
 
 			err := handler.validateConfigResource(req)
 
-			if tt.Err && err == nil {
+			if tt.expectErr && err == nil {
 				t.Errorf("Expected error but received nil")
 			}
-			if !tt.Err && err != nil {
+			if !tt.expectErr && err != nil {
 				t.Errorf("Did not expect error but received: %v", err)
 			}
 		})