Preserve UniFi admission guards while migrating to ValidatingPolicy #5459

🤖 Generated by the Agentic Engineer

Objective

Preserve the existing UniFi apply, observe-only and deletion boundaries while replacing their retiring ClusterPolicy API with ValidatingPolicy. This is one independently deployable slice of #4995, not a network-configuration change.

Evidence and scope

At Platform source a2b34a68d839754a411168de919985b9f3f21ea5, the existing four fixture families produce 19 passing expected outcomes on both Kyverno 1.19.1 and the current 1.19.2 CLI. The three legacy rules separately check ordinary apply, observe-only annotations and deletion of the stored object; other applying identities are excluded. Missing and empty management-policy lists have conservative existing defaults that must be retained.

Represent the three independently testable legacy rules as equivalent ValidatingPolicy resources where needed to preserve their individual expected results. Retain the existing API groups, resource coverage, admission operations, namespace/source-writer boundary, failure action and controller/operator exclusions. Do not expand supported resource kinds or alter the managed network objects.

Acceptance criteria

• Preserve the 19 original resource/outcome cases and old-policy baseline receipts. Add meaningful controls for UPDATE, default/empty/null values, wrong scope and unrelated identities before rewriting; prove the relevant assertions fail when each protection is broken.
• The replacement policies preserve CREATE/UPDATE incoming-object checks and DELETE stored-object checks, literal wildcard/Delete handling, exact observe-only behavior and the original denial behavior. Keep individual legacy-rule outcome parity explicit.
• Stage the migration without an enforcement gap: first deploy the replacement policies alongside the unchanged legacy guard and verify each replacement Ready against the published source; only then remove the legacy ClusterPolicy in a separate protected change. Temporary validation overlap must not change the admitted object. Keep each new policy's resource coverage aligned with the existing tenant Role, and retain an adverse control that rejects drift.
• Adapt the fixture-evaluation/failure-action and effective-policy consumers without dropping meaningful coverage. Full applicable policy tests, offline regressions and manifest-layer validation pass; do not suppress readiness/reporting failures or broaden permissions to hide them.
• Obtain current-head substantive review and complete required CI, then use the normal protected merge/deployment path. After deployment, read back every replacement as Ready and the old ClusterPolicy as absent, binding the evidence to the published source. Local tests and pre-existing stored objects alone are not production acceptance.

Boundaries and priority

Part of #4995. The separate additional-resource work in #4992 and the parent's other validation policies remain independent. No local cluster, ad-hoc writes to managed resources, provider/account/credential change, network mutation, paid service or unrelated release activation is required or authorized by this task.

Priority High; Effort Medium; Service class Risk reduction. The current guard already works; this preserves it across the planned API retirement rather than treating a future upgrade as a current incident.

Delivered on: 2026-10-28. Native acceptance: #5459 (comment)