Repository navigation
Migrate the tenant and organisation validation ClusterPolicies to ValidatingPolicy #4995
Description
🤖 Generated by the Agentic Engineer (interactive Claude Code session)
Evidence and problem
Kyverno 1.20 is planned to remove ClusterPolicy (#4984). These 12 validation policies in k8s/bases/infrastructure/cluster-policies/best-practices/ guard tenants, GitHub organisation management and retirements; each must exist as a ValidatingPolicy (policies.kyverno.io) before 1.20 is installed:
audit-privileged-rbac, restrict-arc-openbao-listener, restrict-arc-retirement, restrict-explicit-dns-records, restrict-github-team-external-identity, restrict-github-team-management, restrict-homepage-service-groups, restrict-tenant-issuer-refs, restrict-tenant-network-policies, restrict-tenant-route-hostnames, restrict-tenant-secret-stores, restrict-unifi-management-policies.
Ten of the twelve already have Kyverno CLI tests; restrict-arc-openbao-listener and restrict-arc-retirement have none.
How every migration batch works
- Test first. Of the 49
ClusterPolicymanifests, 28 are named in notests/**/kyverno-test.yaml(counted 2026-10-17 by policy name). Before rewriting a policy, add a Kyverno CLI test that pins its current behaviour — at least one resource it must act on and one it must leave alone — and see it pass against theClusterPolicy. The same test, pointed at the new kind, must pass unchanged in its expected results. - Keep the action. Each rewritten policy keeps its failure action as recorded in
tests/policy-failure-actions.json(Enforce stays Enforce, Audit stays Audit), its match scope and its exclusions. - No gap in enforcement. Add the new policy and delete the
ClusterPolicyin the same PR, so Flux applies the replacement before it prunes the old one. Kinds whose two versions could both act on the same request (mutation or generation) say how double application is avoided. - Confirm the capability first. For each rule, confirm the replacement kind can express it at Kyverno 1.19.1 (the running version). A rule it cannot express is recorded on Migrate Kyverno ClusterPolicy and Policy before Kyverno 1.20 removes them #4984 and blocks only that policy, not the batch.
- Validate with
kyverno test ./testsandscripts/validate-kyverno-fixture-evaluation.sh(CI's⚖️ Validate cluster policiesstep), the layer builds inplatform/AGENTS.md, and after deploy a read-only check that each new policy reports ready and the old one is gone.
Acceptance criteria
- Every policy listed above has a CLI test that passed against the
ClusterPolicybefore the rewrite. - Each is a
ValidatingPolicywith the same failure action, scope and exclusions, and the oldClusterPolicyis deleted in the same PR. -
kyverno test ./testsand the fixture-evaluation check pass in CI. - After deploy, each new policy reports ready and no
ClusterPolicyof these names remains.
Priority High, Effort High, Service class Risk reduction. These rules keep tenants inside their boundaries; losing them in a 1.20 upgrade would be silent. Effort includes adding the missing tests, the CEL rewrite, review and one production deploy. No prerequisite; #4994 removes the time pressure but is not required first. Part of #4984.
Metadata
Metadata
Assignees
Labels
Type
Fields
Priority
Effort
Projects
- Status
Activity
chore: agent-claim #4995 nonce=5a07cfd33a60dbf076c44f3e52a87dcd
test(kyverno): pin two restrict-arc-retirement rules before the rewrite
test(kyverno): pin restrict-arc-retirement's namespace deletion rule
test(kyverno): pin restrict-arc-retirement's credential-sync update rule
test(kyverno): pin restrict-arc-retirement's journal preservation rule
test(kyverno): drop a trailing blank line from a retirement fixture
devantler commentedon Oct 17, 2026
Progress — test-first step for the two untested policies (platform#5031, merged 2026-10-17 21:18Z)
restrict-arc-openbao-listenernow has CLI tests: the audited listener passes, the same name outsideopenbaofails, and extra data,binaryDataor a changed listener each fail.restrict-arc-retirementhas CLI tests for 5 of its 8 rules:fence-retired-listener-pod,fence-retired-secret,preserve-retiring-namespace,fence-credential-recreation(the update path past baseline) andpreserve-retirement-journal. The journal that the policy reads by API call is supplied throughvalues.yaml, per resource.Still to do before this policy's rewrite:
fence-pool-retirement,fence-scale-set-retirementandfence-listener-retirement. They compare the request against whole recorded baseline specs, so their fixtures need a full baseline record invalues.yaml. The other ten policies already had tests, so the CEL rewrite itself has not started.7 remaining items
chore: agent-claim #4995 nonce=a8657036430abef1c9563cbb2f0fd860
chore: agent-claim #4995 nonce=19c5b98890aec84dd5b0dbb7920a69f9
chore: agent-claim #4995 nonce=59144466e3d0ee4f864a28129e560d3c
chore: agent-claim #4995 nonce=dffcbf8863ed4bab576087ae7087ff07
chore: agent-claim #4995 nonce=a6386412fbbd40f10753550feb64f9d0
devantler commentedon Nov 2, 2026
Progress:
restrict-tenant-issuer-refsis now aValidatingPolicyin production (3 of 12).15312e2a65425e7a70f337235bce72adae13d6d0through the merge queue.ValidatingPolicyof that name reports ready, and noClusterPolicyof that name remains.#5743, #5749, #5751 are in the merge queue and #5756 is in review. Each gets its own line here once it has deployed.
chore: agent-claim #4995 nonce=0192272c0219c161fb2e6a5375158437
devantler commentedon Nov 2, 2026
Progress:
restrict-tenant-route-hostnamesis now aValidatingPolicyin production (4 of 12).09459e98c646aae34ed32481e584d08d13e49ac9through the merge queue.ValidatingPolicyof that name reports ready, and noClusterPolicyof that name remains.This read checks that the replacement took place. It did not send a live request to the policy; the same-denial evidence is on #5749.
devantler commentedon Nov 2, 2026
Progress:
restrict-github-team-external-identityis now aValidatingPolicyin production (5 of 12).b7f918d977e2ccb2b0b9862ac791ef75b89bff15through the merge queue.ValidatingPolicyof that name reports ready, and noClusterPolicyof that name remains.#5743, #5756 and #5758 are still queued and are recorded when each one deploys.
devantler commentedon Nov 2, 2026
Progress:
audit-privileged-rbacis now aValidatingPolicyin production (6 of 12).cba710438002d16d834c38518faaa3d644e48f6fthrough the merge queue.ValidatingPolicyof that name reports ready with actionDeny, noClusterPolicyof that name remains, and its reports hold 327 passing results and no failures.#5743 and #5756 are still queued and are recorded when each one deploys.
devantler commentedon Nov 2, 2026
Progress:
restrict-homepage-service-groupsis now aValidatingPolicyin production (7 of 12).7754ca5c0c6b2cbe95ae66619c01ed63c05ade56through the merge queue.ValidatingPolicyof that name reports ready with actionDeny, noClusterPolicyof that name remains, and its reports hold 13 passing results and no failures.#5756 is still queued and is recorded when it deploys.
devantler commentedon Nov 10, 2026
Progress, read from production on 10 November about 17:25Z: 10 of the 12 listed policies are now
ValidatingPolicyand theirClusterPolicyis gone.restrict-github-team-management: refactor(policy): move the GitHub team management guard to ValidatingPolicy #5756 merged on 4 November as33497bde5f96acafee329785aef421c5de7f3c89. ItsValidatingPolicyreports ready, and noClusterPolicyof that name remains. This was not recorded here when it deployed.restrict-unifi-management-policiesno longer exists under that name. Its rules now live in threeValidatingPolicyobjects,restrict-unifi-apply-management-policies,restrict-unifi-observe-onlyandrestrict-unifi-prune-management-policies. All three report ready, and noClusterPolicyof the old name remains.ClusterPolicyleft.Two remain as
ClusterPolicy:restrict-arc-openbao-listener: its replacementrestrict-arc-openbao-listener-settingsruns alongside it and reports ready. Removing the old one is tracked in Preserve the public listener guard while migrating its validation API #5464, which is waiting on the cross-group selector parity and the reporting fix in Stop wildcard report watcher failures without broadening access #4929.restrict-arc-retirement: not started. It now has CLI tests (thetests/restrict-arc-retirement-*fixtures), so the "no tests" note in this issue's evidence is out of date. Its eight rules read thearc-runnersNamespace through API calls, which makes the rewrite larger than the earlier batches. It needs its own slice issue before work starts.