feat(linter): check for nested resource-policy annotations

The 'helm.sh/resource-policy' annotation is only supported on top level
objects.  The annotation is ignored if given on a nested object within a
list.

Ref #9829

Signed-off-by: Adam Reese <adam@reese.io>

pkg/lint/rules/template.go

@@ -146,6 +146,7 @@ func Templates(linter *support.Linter, values map[string]interface{}, namespace
 					linter.RunLinterRule(support.WarningSev, fpath, validateNoDeprecations(yamlStruct))
 
 					linter.RunLinterRule(support.ErrorSev, fpath, validateMatchSelector(yamlStruct, renderedContent))
+					linter.RunLinterRule(support.ErrorSev, fpath, validateListAnnotations(yamlStruct, renderedContent))
 				}
 			}
 		}
@@ -293,6 +294,28 @@ func validateMatchSelector(yamlStruct *K8sYamlStruct, manifest string) error {
 	}
 	return nil
 }
+func validateListAnnotations(yamlStruct *K8sYamlStruct, manifest string) error {
+	if yamlStruct.Kind == "List" {
+		m := struct {
+			Items []struct {
+				Metadata struct {
+					Annotations map[string]string
+				}
+			}
+		}{}
+
+		if err := yaml.Unmarshal([]byte(manifest), &m); err != nil {
+			return validateYamlContent(err)
+		}
+
+		for _, i := range m.Items {
+			if _, ok := i.Metadata.Annotations["helm.sh/resource-policy"]; ok {
+				return errors.New("Annotation 'helm.sh/resource-policy' within List objects are ignored")
+			}
+		}
+	}
+	return nil
+}
 
 // K8sYamlStruct stubs a Kubernetes YAML file.
 //

pkg/lint/rules/template_test.go

@@ -424,3 +424,41 @@ func TestEmptyWithCommentsManifests(t *testing.T) {
 		t.Fatalf("Expected 0 lint errors, got %d", l)
 	}
 }
+func TestValidateListAnnotations(t *testing.T) {
+	md := &K8sYamlStruct{
+		APIVersion: "v1",
+		Kind:       "List",
+		Metadata: k8sYamlMetadata{
+			Name: "list",
+		},
+	}
+	manifest := `
+apiVersion: v1
+kind: List
+items:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      annotations:
+        helm.sh/resource-policy: keep
+`
+
+	if err := validateListAnnotations(md, manifest); err == nil {
+		t.Fatal("expected list with nested keep annotations to fail")
+	}
+
+	manifest = `
+apiVersion: v1
+kind: List
+metadata:
+  annotations:
+    helm.sh/resource-policy: keep
+items:
+  - apiVersion: v1
+    kind: ConfigMap
+`
+
+	if err := validateListAnnotations(md, manifest); err != nil {
+		t.Fatalf("List objects keep annotations should pass. got: %s", err)
+	}
+}