fix(cozystack-basics): gate the hostname VAP policies on the VAP API by lexfrei · Pull Request #3409 · cozystack/cozystack

Aleksei Sviridkin (lexfrei) · 2026-07-21T21:22:50Z

What this PR does

Wraps the route, gateway, and ingress hostname ValidatingAdmissionPolicy templates in a .Capabilities.APIVersions.Has gate so they render only where the VAP API is available. Without it, an operator-generated HelmRelease with drift detection off renders the policies out at first install on a cluster missing the API and never adds them back. Each template gains a sibling test asserting it renders zero documents when the API is absent. Install-robustness fix, split out from #3299.

fix(cozystack-basics): hostname ValidatingAdmissionPolicies render only where the VAP API is available, so a first install on a cluster without it no longer drops them permanently.

Summary by CodeRabbit

Bug Fixes
- Hostname validation policies now render only when the Kubernetes admission policy API is available, preventing unsupported policy resources on older clusters.
Tests
- Added/updated unit tests to explicitly simulate both missing and present admission policy API capabilities, ensuring templates render (or not) as expected.

gemini-code-assist · 2026-07-21T21:22:53Z

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

coderabbitai · 2026-07-21T21:23:20Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9cbdc036-1b9b-4fff-98f5-bfc0e95bbe28

📥 Commits

Reviewing files that changed from the base of the PR and between 41fdd91 and 267ea51.

📒 Files selected for processing (7)

packages/system/cozystack-basics/templates/gateway-hostname-policy.yaml
packages/system/cozystack-basics/templates/ingress-hostname-policy.yaml
packages/system/cozystack-basics/templates/route-hostname-policy.yaml
packages/system/cozystack-basics/tests/gateway-hostname-policy_test.yaml
packages/system/cozystack-basics/tests/hostname-policies-capability-gate_test.yaml
packages/system/cozystack-basics/tests/ingress-hostname-policy_test.yaml
packages/system/cozystack-basics/tests/route-hostname-policy_test.yaml

🚧 Files skipped from review as they are similar to previous changes (5)

packages/system/cozystack-basics/tests/hostname-policies-capability-gate_test.yaml
packages/system/cozystack-basics/templates/ingress-hostname-policy.yaml
packages/system/cozystack-basics/tests/gateway-hostname-policy_test.yaml
packages/system/cozystack-basics/templates/route-hostname-policy.yaml
packages/system/cozystack-basics/tests/route-hostname-policy_test.yaml

📝 Walkthrough

Walkthrough

Hostname policy Helm templates now check for the Kubernetes ValidatingAdmissionPolicy API before rendering. Existing tests declare the capability, and new coverage verifies that route, gateway, and ingress policies produce no documents when it is unavailable.

Changes

Hostname policy capability gating

Layer / File(s)	Summary
Add API capability guards `packages/system/cozystack-basics/templates/*-hostname-policy.yaml`	Route, gateway, and ingress ValidatingAdmissionPolicy resources now render only when the required API capability is available.
Update capability-aware tests `packages/system/cozystack-basics/tests/*hostname-policy_test.yaml`, `packages/system/cozystack-basics/tests/hostname-policies-capability-gate_test.yaml`	Existing tests declare the API capability, and a new suite verifies that all three policy templates render no documents when it is unavailable.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

cozystack/cozystack#3200: Modifies related Ingress ValidatingAdmissionPolicy template rendering.
cozystack/cozystack#3410: Adds similar API capability gating and tests for another cozystack-basics policy template.

Suggested labels: area/kubernetes

Suggested reviewers: androndo, kvaps, myasnikovdaniil, sircthulhu, ivanhunters

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the main change: gating hostname VAP policies on the VAP API.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/vap-api-capability-gate

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

packages/system/cozystack-basics/templates/gateway-hostname-policy.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

packages/system/cozystack-basics/templates/ingress-hostname-policy.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

packages/system/cozystack-basics/templates/route-hostname-policy.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

4 others

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Render the route, gateway and ingress hostname ValidatingAdmissionPolicies only where the admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy API is served, matching the deletion-protection guard, so a cluster without that API does not receive an unrenderable resource. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>

github-actions · 2026-07-23T11:55:06Z

Successfully created backport PR for release-1.6:

[Backport release-1.6] fix(cozystack-basics): gate the hostname VAP policies on the VAP API #3442

…olicies on the VAP API (#3442) # Description Backport of #3409 to `release-1.6`.

github-actions · 2026-08-17T10:14:31Z

Created backport PR for release-1.5:

[Backport release-1.5] fix(cozystack-basics): gate the hostname VAP policies on the VAP API #3876 with remaining conflicts!

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin backport-3409-to-release-1.5
git worktree add --checkout .worktree/backport-3409-to-release-1.5 backport-3409-to-release-1.5
cd .worktree/backport-3409-to-release-1.5
git reset --hard HEAD^
git cherry-pick -x 267ea513adeee270e97f8d91d21b6242fc09f8f1
git push --force-with-lease

Backport of #3409 to release-1.5. gateway-hostname-policy.yaml and route-hostname-policy.yaml rendered their ValidatingAdmissionPolicy and binding documents unconditionally, so installing the chart against an API server that does not serve admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy failed. Guard both on the capability, matching the existing pattern in packages/core/platform/templates/deletion-protection.yaml, and declare the capability in the two rendering test suites so they keep exercising the policies. hostname-policies-capability-gate_test.yaml pins the absent-API case at suite level, since helm-unittest merges per-test capabilities into the suite's rather than replacing them. The upstream change also gated a third template, ingress-hostname-policy.yaml. That legacy-Ingress hostname policy landed on main in d89ad7069 and was never backported, so it does not exist on release-1.5 and is deliberately excluded here: importing it would ship an unreviewed admission policy that starts rejecting tenant Ingress hostnames in a patch release. Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

…olicies on the VAP API (#3876) # Description Backport of #3409 to `release-1.5`.

Aleksei Sviridkin (lexfrei) requested review from IvanHunters, Andrey Kolkov (androndo), Andrei Kvapil (kvaps), Timofei Larkin (lllamnyp), myasnikovdaniil and Kirill Ilin (sircthulhu) as code owners July 21, 2026 21:22

github-actions Bot added area/uncategorized PR auto-labeler could not map title scope to a known area/*; please review kind/bug Categorizes issue or PR as related to a bug labels Jul 21, 2026

Aleksei Sviridkin (lexfrei) mentioned this pull request Jul 21, 2026

feat(controller): engine-agnostic CA extraction for the tenant trust anchor #3299

Closed

github-actions Bot added the size/M This PR changes 30-99 lines, ignoring generated files label Jul 21, 2026

dosubot Bot added area/networking Issues or PRs related to networking (ingress, gateway, vpn, metallb, kube-ovn) area/testing Issues or PRs related to testing (e2e, bats, unit tests) backport Should change be backported on previous release labels Jul 21, 2026

Aleksei Sviridkin (lexfrei) self-assigned this Jul 22, 2026

Timofei Larkin (lllamnyp) approved these changes Jul 22, 2026

View reviewed changes

Aleksei Sviridkin (lexfrei) force-pushed the fix/vap-api-capability-gate branch from 41fdd91 to 267ea51 Compare July 23, 2026 09:40

Aleksei Sviridkin (lexfrei) merged commit 0ba79c0 into main Jul 23, 2026
15 checks passed

Aleksei Sviridkin (lexfrei) deleted the fix/vap-api-capability-gate branch July 23, 2026 11:54

github-actions Bot mentioned this pull request Jul 23, 2026

[Backport release-1.6] fix(cozystack-basics): gate the hostname VAP policies on the VAP API #3442

Merged

IvanHunters mentioned this pull request Jul 23, 2026

feat(db-autoscaler): implement Database Horizontal Autoscaler operator #3381

Closed

11 tasks

Aleksei Sviridkin (lexfrei) mentioned this pull request Jul 27, 2026

Unified TLS certificate and external-exposure model #2811

Open

myasnikovdaniil added a commit that referenced this pull request Jul 31, 2026

[Backport release-1.6] fix(cozystack-basics): gate the hostname VAP p…

b787311

…olicies on the VAP API (#3442) # Description Backport of #3409 to `release-1.6`.

myasnikovdaniil mentioned this pull request Aug 3, 2026

chore(ci): namespace the backport labels under kind/ #3433

Closed

1 task

myasnikovdaniil mentioned this pull request Aug 12, 2026

fix(cozystack-basics): normalize tenant hostname VAP comparisons with lowerAscii #3208

Merged

myasnikovdaniil added the backport-previous Backport target — previous release line label Aug 17, 2026

github-actions Bot mentioned this pull request Aug 17, 2026

[Backport release-1.5] fix(cozystack-basics): gate the hostname VAP policies on the VAP API #3876

Merged

myasnikovdaniil added a commit that referenced this pull request Aug 19, 2026

[Backport release-1.5] fix(cozystack-basics): gate the hostname VAP p…

99a1d5b

…olicies on the VAP API (#3876) # Description Backport of #3409 to `release-1.5`.

Navigation Menu

Uh oh!

fix(cozystack-basics): gate the hostname VAP policies on the VAP API - #3409

fix(cozystack-basics): gate the hostname VAP policies on the VAP API#3409
Aleksei Sviridkin (lexfrei) merged 1 commit into
mainfrom
fix/vap-api-capability-gate

Aleksei Sviridkin (lexfrei) commented Jul 21, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

gemini-code-assist Bot commented Jul 21, 2026

Uh oh!

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

github-actions Bot commented Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Aleksei Sviridkin (lexfrei) commented Jul 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Summary by CodeRabbit

Uh oh!

gemini-code-assist Bot commented Jul 21, 2026

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

github-actions Bot commented Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Aleksei Sviridkin (lexfrei) commented Jul 21, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading