Skip to content

Commit 6026857

Browse files
myasnikovdaniilmyasnikovdaniil
committed
fix(platform): drop redundant failurePolicy on no-delete VAP
Address review feedback from @lllamnyp on packages/core/platform/templates/ deletion-protection.yaml: the VAP's validation expression is the literal `false` — no parameters, no variables, no references — so CEL evaluation cannot fail and the api-server never has occasion to apply failurePolicy. The previous `failurePolicy: Fail` line was a no-op masquerading as operational config. Drop the field (the default is Fail anyway in admissionregistration.k8s.io/v1) and document in the template comment why it is intentionally absent, so the next reader does not re-add it on the assumption that it was forgotten. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
1 parent 572e08a commit 6026857

1 file changed

Lines changed: 4 additions & 1 deletion

File tree

‎packages/core/platform/templates/deletion-protection.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@
99

1010
Bypass: remove the label, then delete.
1111
kubectl label <kind> <name> platform.cozystack.io/no-delete-
12+
13+
failurePolicy is intentionally omitted: the validation expression is the
14+
literal `false`, so CEL evaluation cannot fail and the default (Fail) is
15+
unreachable in practice. Setting it explicitly would be misleading config.
1216
*/}}
1317
{{- if .Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy" }}
1418
---
@@ -19,7 +23,6 @@ metadata:
1923
labels:
2024
platform.cozystack.io/no-delete: "true"
2125
spec:
22-
failurePolicy: Fail
2326
matchConstraints:
2427
resourceRules:
2528
- apiGroups: ["*"]

0 commit comments

Comments
 (0)