# infrastructure/modules/base/storageclass/cassandra-storage-policy.yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: cassandra-storage-namespace
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["persistentvolumeclaims"]
  validations:
    - expression: "!has(object.spec.storageClassName) || !(object.spec.storageClassName in ['cassandra-db', 'cassandra-artifacts']) || object.metadata.namespace == 'cassandra'"
      message: "Cassandra storage classes are reserved for namespace cassandra"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: cassandra-storage-namespace
spec:
  policyName: cassandra-storage-namespace
  validationActions:
    - Deny