longhorn has no authentication at the moment, so any workload running in your cluster can send API requests to delete any volume. I think they are working on it

longhorn has no authentication at the moment, so any workload running in your cluster can send API requests to delete any volume. I think they are working on it but it might not be the best solution unless you deploy a security policy to prevent network access to the API pod.