744 ignoring resources with deletionTimestamp

pkg/engine/validation.go

@@ -97,11 +97,6 @@ func incrementAppliedCount(resp *response.EngineResponse) {
 func isRequestDenied(log logr.Logger, ctx context.EvalInterface, policy kyverno.ClusterPolicy, resource unstructured.Unstructured, admissionInfo kyverno.RequestInfo) *response.EngineResponse {
 	resp := &response.EngineResponse{}
 
-	// deny logic will only be applied to requests from user - system related requests are ignored.
-	if admissionInfo.AdmissionUserInfo.Username != "kubernetes-admin" {
-		return resp
-	}
-
 	for _, rule := range policy.Spec.Rules {
 		if !rule.HasValidate() {
 			continue

pkg/webhooks/server.go

@@ -355,6 +355,15 @@ func (ws *WebhookServer) resourceValidation(request *v1beta1.AdmissionRequest) *
 		logger.Error(err, "failed to load service account in context")
 	}
 
+	if val, err := ctx.Query("request.object.metadata.deletionTimestamp"); val != nil && err == nil {
+		return &v1beta1.AdmissionResponse{
+			Allowed: true,
+			Result: &metav1.Status{
+				Status: "Success",
+			},
+		}
+	}
+
 	// VALIDATION
 	ok, msg := ws.HandleValidation(request, policies, nil, ctx, userRequestInfo)
 	if !ok {