feat: skip validation of helm release information (#425)

* feat: skip validation of helm release information

pkg/services/resourceFilterService_test.go

@@ -92,6 +92,15 @@ func TestPrerequisitesFilters(t *testing.T) {
 			ShouldValidate: false,
 		}, ShouldResourceBeValidated(admissionReviewReq, rootObject))
 	})
+	t.Run("resource should be skipped because it has Secret kind and name related to Helm release metadata", func(t *testing.T) {
+		admissionReviewReq, rootObject := extractAdmissionReviewReqAndRootObject(templateResource)
+		admissionReviewReq.Request.Kind.Kind = "Secret"
+		rootObject.Metadata.Name = "sh.helm.release.v1.my-release2.v3.v3"
+		rootObject.Metadata.Labels["owner"] = "helm"
+		assert.Equal(t, ShouldValidatedResourceData{
+			ShouldValidate: false,
+		}, ShouldResourceBeValidated(admissionReviewReq, rootObject))
+	})
 	t.Run("resource should be skipped because namespace is kube-public", func(t *testing.T) {
 		admissionReviewReq, rootObject := extractAdmissionReviewReqAndRootObject(templateResource)
 		admissionReviewReq.Request.Namespace = "kube-public"

pkg/services/resourcesFilterService.go

@@ -36,6 +36,8 @@ func ShouldResourceBeValidated(admissionReviewReq *admission.AdmissionReview, ro
 	}
 
 	resourceKind := admissionReviewReq.Request.Kind.Kind
+	resourceName := rootObject.Metadata.Name
+	resourceLabels := rootObject.Metadata.Labels
 	managedFields := rootObject.Metadata.ManagedFields
 	userInfo := admissionReviewReq.Request.UserInfo
 	resourceAnnotations := rootObject.Metadata.Annotations
@@ -47,6 +49,14 @@ func ShouldResourceBeValidated(admissionReviewReq *admission.AdmissionReview, ro
 	isNamespaceThatShouldBeSkipped := isNamespaceThatShouldBeSkipped(admissionReviewReq)
 	arePrerequisitesMet := isMetadataNameExists && !isUnsupportedKind && !isResourceDeleted && !isNamespaceThatShouldBeSkipped
 
+	// if the resource is a helm release metadata, we don't want to validate it
+	// https://stackoverflow.com/questions/66244697/where-does-helm-store-installation-state
+	if isHelmReleaseMetadata(resourceName, resourceLabels) {
+		return ShouldValidatedResourceData{
+			ShouldValidate: false,
+		}
+	}
+
 	if !arePrerequisitesMet {
 		return ShouldValidatedResourceData{
 			ShouldValidate: false,
@@ -137,6 +147,10 @@ func isNamespaceThatShouldBeSkipped(admissionReviewReq *admission.AdmissionRevie
 	return slices.Contains(namespacesToSkip, admissionReviewReq.Request.Namespace)
 }
 
+func isHelmReleaseMetadata(resourceName string, labels map[string]string) bool {
+	return strings.Contains(resourceName, "sh.helm.release.v1.") && labels["owner"] == "helm"
+}
+
 func isObjectAndOldObjectEqual(admissionReviewReq *admission.AdmissionReview) bool {
 	if admissionReviewReq.Request.OldObject.Raw == nil {
 		return false