apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: protect-critical-namespaces
spec:
  validationFailureAction: Enforce
  background: false   
  rules:
    - name: deny-deletion-of-critical-namespaces
      match:
        any:
          - resources:
              kinds:
                - Namespace
              names:
                - keda-demand-prd
                - contour-internal-0-demand-prd
                - contour-internal-0-demand-prd-intra
                - contour-external-demand-prd
                - external-secrets-demand-prd
                - flagger-demand-prd
                - victoriametrics
                - kube-system
                - monitoring
                - telegraf-operator
                - loadtester
                - opentelemetry
                - fluentd
                - kube-events
                - observability
                - contour-cert-checker-ns
                - aurva-dataplane
      validate:
        message: "Deletion of critical namespaces is not allowed."
        deny:
          conditions:
            any:
              - key: "{{request.operation}}"
                operator: Equals
                value: DELETE