Skip to content

fix(cozystack-basics): gate the hostname VAP policies on the VAP API - #3409

Merged
Aleksei Sviridkin (lexfrei) merged 1 commit into
mainfrom
fix/vap-api-capability-gate
Jul 23, 2026
Merged

fix(cozystack-basics): gate the hostname VAP policies on the VAP API#3409
Aleksei Sviridkin (lexfrei) merged 1 commit into
mainfrom
fix/vap-api-capability-gate

Conversation

@lexfrei

@lexfrei Aleksei Sviridkin (lexfrei) commented Jul 21, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

What this PR does

Wraps the route, gateway, and ingress hostname ValidatingAdmissionPolicy templates in a .Capabilities.APIVersions.Has gate so they render only where the VAP API is available. Without it, an operator-generated HelmRelease with drift detection off renders the policies out at first install on a cluster missing the API and never adds them back. Each template gains a sibling test asserting it renders zero documents when the API is absent. Install-robustness fix, split out from #3299.

fix(cozystack-basics): hostname ValidatingAdmissionPolicies render only where the VAP API is available, so a first install on a cluster without it no longer drops them permanently.

Summary by CodeRabbit

  • Bug Fixes
    • Hostname validation policies now render only when the Kubernetes admission policy API is available, preventing unsupported policy resources on older clusters.
  • Tests
    • Added/updated unit tests to explicitly simulate both missing and present admission policy API capabilities, ensuring templates render (or not) as expected.

@gemini-code-assist

gemini-code-assist Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

@github-actions github-actions Bot added area/uncategorized PR auto-labeler could not map title scope to a known area/*; please review kind/bug Categorizes issue or PR as related to a bug labels Jul 21, 2026
@coderabbitai

coderabbitai Bot commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9cbdc036-1b9b-4fff-98f5-bfc0e95bbe28

📥 Commits

Reviewing files that changed from the base of the PR and between 41fdd91 and 267ea51.

📒 Files selected for processing (7)
  • packages/system/cozystack-basics/templates/gateway-hostname-policy.yaml
  • packages/system/cozystack-basics/templates/ingress-hostname-policy.yaml
  • packages/system/cozystack-basics/templates/route-hostname-policy.yaml
  • packages/system/cozystack-basics/tests/gateway-hostname-policy_test.yaml
  • packages/system/cozystack-basics/tests/hostname-policies-capability-gate_test.yaml
  • packages/system/cozystack-basics/tests/ingress-hostname-policy_test.yaml
  • packages/system/cozystack-basics/tests/route-hostname-policy_test.yaml
🚧 Files skipped from review as they are similar to previous changes (5)
  • packages/system/cozystack-basics/tests/hostname-policies-capability-gate_test.yaml
  • packages/system/cozystack-basics/templates/ingress-hostname-policy.yaml
  • packages/system/cozystack-basics/tests/gateway-hostname-policy_test.yaml
  • packages/system/cozystack-basics/templates/route-hostname-policy.yaml
  • packages/system/cozystack-basics/tests/route-hostname-policy_test.yaml
📝 Walkthrough

Walkthrough

Hostname policy Helm templates now check for the Kubernetes ValidatingAdmissionPolicy API before rendering. Existing tests declare the capability, and new coverage verifies that route, gateway, and ingress policies produce no documents when it is unavailable.

Changes

Hostname policy capability gating

Layer / File(s) Summary
Add API capability guards
packages/system/cozystack-basics/templates/*-hostname-policy.yaml		 Route, gateway, and ingress ValidatingAdmissionPolicy resources now render only when the required API capability is available.
Update capability-aware tests
packages/system/cozystack-basics/tests/*hostname-policy_test.yaml, packages/system/cozystack-basics/tests/hostname-policies-capability-gate_test.yaml		 Existing tests declare the API capability, and a new suite verifies that all three policy templates render no documents when it is unavailable.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

Suggested labels: area/kubernetes

Suggested reviewers: androndo, kvaps, myasnikovdaniil, sircthulhu, ivanhunters

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly states the main change: gating hostname VAP policies on the VAP API.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/vap-api-capability-gate

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)
packages/system/cozystack-basics/templates/gateway-hostname-policy.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

packages/system/cozystack-basics/templates/ingress-hostname-policy.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

packages/system/cozystack-basics/templates/route-hostname-policy.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

  • 4 others

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@lexfrei Aleksei Sviridkin (lexfrei) mentioned this pull request Jul 21, 2026
Closed
@github-actions github-actions Bot added the size/M This PR changes 30-99 lines, ignoring generated files label Jul 21, 2026
@dosubot dosubot Bot added area/networking Issues or PRs related to networking (ingress, gateway, vpn, metallb, cilium, kube-ovn) area/testing Issues or PRs related to testing (e2e, bats, unit tests) backport Should change be backported on previous release labels Jul 21, 2026
@lexfrei
fix(cozystack-basics): gate the hostname VAP policies on the VAP API
267ea51 
Render the route, gateway and ingress hostname ValidatingAdmissionPolicies
only where the admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy API
is served, matching the deletion-protection guard, so a cluster without that
API does not receive an unrenderable resource.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
@lexfrei
Aleksei Sviridkin (lexfrei) merged commit 0ba79c0 into main Jul 23, 2026
15 checks passed
@lexfrei
Aleksei Sviridkin (lexfrei) deleted the fix/vap-api-capability-gate branch July 23, 2026 11:54
@github-actions

github-actions Bot commented Jul 23, 2026

Copy link
Copy Markdown

Successfully created backport PR for release-1.6:

@github-actions github-actions Bot mentioned this pull request Jul 23, 2026
Merged
@IvanHunters IvanHunters mentioned this pull request Jul 23, 2026
Open
11 tasks
@lexfrei Aleksei Sviridkin (lexfrei) mentioned this pull request Jul 27, 2026
Open
myasnikovdaniil added a commit that referenced this pull request Jul 31, 2026
@myasnikovdaniil
[Backport release-1.6] fix(cozystack-basics): gate the hostname VAP p…
b787311 
…olicies on the VAP API (#3442)

# Description
Backport of #3409 to `release-1.6`.
@myasnikovdaniil myasnikovdaniil mentioned this pull request Aug 3, 2026
Open
1 task
@myasnikovdaniil myasnikovdaniil mentioned this pull request Aug 12, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lllamnyp Timofei Larkin (lllamnyp) lllamnyp approved these changes
@kvaps Andrei Kvapil (kvaps) Awaiting requested review from kvaps kvaps is a code owner
@androndo Andrey Kolkov (androndo) Awaiting requested review from androndo
@IvanHunters IvanHunters Awaiting requested review from IvanHunters IvanHunters is a code owner
@sircthulhu Kirill Ilin (sircthulhu) Awaiting requested review from sircthulhu sircthulhu is a code owner
@myasnikovdaniil myasnikovdaniil Awaiting requested review from myasnikovdaniil myasnikovdaniil is a code owner

Assignees

@lexfrei Aleksei Sviridkin (lexfrei)

Labels

area/networking Issues or PRs related to networking (ingress, gateway, vpn, metallb, cilium, kube-ovn) area/testing Issues or PRs related to testing (e2e, bats, unit tests) area/uncategorized PR auto-labeler could not map title scope to a known area/*; please review backport Should change be backported on previous release kind/bug Categorizes issue or PR as related to a bug size/M This PR changes 30-99 lines, ignoring generated files

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lexfrei @lllamnyp