Skip to content

Commit c1ac16e

Browse files
myasnikovdaniilmyasnikovdaniil
committed
feat(platform): NOTES.txt warns when no-delete VAP is silently skipped
Address review feedback from @lexfrei on packages/core/platform/templates/ deletion-protection.yaml: on a pre-1.30 cluster the capability gate (`.Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1/ ValidatingAdmissionPolicy"`) evaluates to false and the policy + Binding render to nothing. There was no signal in `helm install`/`helm upgrade` output that the guardrail had been silently skipped, so operators on older clusters lost the protection without any way to discover that from the install log. Compounded the integration-test gap @lllamnyp called out in blocker 3. Add packages/core/platform/templates/NOTES.txt that renders a multi-line WARNING whenever the capability is absent: states the guardrail is NOT active, explains why (1.30+ required), notes that the label is still stamped on every protected object so the guardrail becomes active automatically on the next upgrade after a cluster bump, no migration step required. Add packages/core/platform/tests/notes_capability_gate_test.yaml: positive case asserts the warning text + the 1.30 hint + the label string render on a chart-level `capabilities.apiVersions: []`. Negative case asserts the warning is absent when admissionregistration.k8s.io/v1/ ValidatingAdmissionPolicy is in the capability list. Verified the positive case fails when the warning text is removed from NOTES.txt. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
1 parent 57f7f50 commit c1ac16e

2 files changed

Lines changed: 43 additions & 0 deletions

File tree

‎packages/core/platform/templates/NOTES.txt‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{{- if not (.Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy") }}
2+
3+
WARNING: deletion-protection guardrail is NOT active on this cluster.
4+
5+
The cozystack-no-delete-guardrail ValidatingAdmissionPolicy requires
6+
Kubernetes 1.30+ (admissionregistration.k8s.io/v1 GA). The capability
7+
gate in templates/deletion-protection.yaml detected the API is absent
8+
on this cluster, so the policy and its Binding were not rendered.
9+
Objects carrying platform.cozystack.io/no-delete=true CAN BE DELETED
10+
on this cluster — `kubectl delete configmap cozystack-version -n
11+
cozy-system` will succeed, with no admission denial.
12+
13+
Upgrade the cluster to 1.30+ and re-run `helm upgrade` to render the
14+
policy. The label is already stamped on every protected object by
15+
this chart and by migration 42, so the guardrail becomes active on
16+
the next upgrade with no further migration step required.
17+
18+
{{- end }}

‎packages/core/platform/tests/notes_capability_gate_test.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
suite: NOTES.txt warns when deletion-protection capability gate trips
2+
templates:
3+
- templates/NOTES.txt
4+
release:
5+
name: cozystack
6+
namespace: cozy-system
7+
capabilities:
8+
apiVersions: []
9+
tests:
10+
- it: NOTES.txt warns the operator the guardrail is not active on pre-1.30
11+
asserts:
12+
- matchRegexRaw:
13+
pattern: 'deletion-protection guardrail is NOT active'
14+
- matchRegexRaw:
15+
pattern: 'Upgrade the cluster to 1\.30\+'
16+
- matchRegexRaw:
17+
pattern: 'platform\.cozystack\.io/no-delete=true'
18+
19+
- it: NOTES.txt stays quiet when ValidatingAdmissionPolicy is available
20+
capabilities:
21+
apiVersions:
22+
- admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy
23+
asserts:
24+
- notMatchRegexRaw:
25+
pattern: 'guardrail is NOT active'

0 commit comments

Comments
 (0)