Repository navigation
fix(staging): preserve platform ownership of the ingress hold - #5411
Conversation
Source evaluation for This extends the existing reserved-policy owner rule to the exact staging-hold name in the business namespace for CREATE/UPDATE/DELETE. It keeps both existing trusted platform-controller carve-outs, rejects a controller name in a tenant namespace, and does not reserve that name in other namespaces. The source-only tenant settings and installed hold specification are unchanged. The real pinned Kyverno 1.19.1 CLI first admitted the tenant CREATE/UPDATE/DELETE controls under the previous policy. The new CREATE test was RED. The first correction then exposed the existing-violation UPDATE exception (skip instead of denial); disabling that exception for the reserved-owner rule made the full actor/operation controls pass. The same rule now explicitly refuses untrusted updates to all three generated floor names while their trusted generator remains allowed. All earlier boundary, scaffold and controller controls remain. Validation: the complete 882-test Kyverno suite passed, the complete tenant-network script and its new controls passed, policy CI routing/result controls passed, ShellCheck and diff checks passed. Both local and production KSail validation returned 0. The local tool still reports unrelated Helm expansion skips because its configured credential helper is unavailable, and some unrelated namespace-selector evaluations lack offline labels; these outputs are not complete chart or live admission coverage. No cluster was started. Normal CI/review/queue and post-merge admission/convergence checks are still required. No application, private projection, route, customer identity or portal activation is added. #5247 keeps the remaining staging acceptance. |
…ner-5247-01a1783e
@coderabbitai review |
✅ Action performed
|
|
No actionable comments were generated in the recent review.
 |
| Check name | Status | Explanation |
|---|---|---|
| Description check |  |
The description directly explains the staging hold ownership change and the prevention of unauthorized tenant updates. |
| Title check | |
The title is concise and clearly identifies the staging fix that preserves platform ownership of the ingress hold. |
| Docstring Coverage | |
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 1 files. (2 skipped: 2 unsupported.)
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Readiness evaluation for The exact-head CI run 40430265537 and all six associated native workflow runs succeeded. The complete policy tests exercise tenant CREATE/UPDATE/DELETE refusal for the committed staging hold, the two existing trusted controller exceptions, wrong-namespace identities and ordinary policy names. Local pinned Kyverno 1.19.1 evaluation at this head passed the complete 883-test suite and retained earlier controls. This is actual admission-engine behavior; post-merge cluster convergence and the later traffic acceptance remain separate. CodeRabbit's authenticated summary 6431378150 reviews this exact head with no actionable findings. All review objects, conversation/body/ancillary findings, inline comments and threads were read: no unresolved finding or thread. Current head signature is valid, the base has no overlapping change, and GitHub reports CLEAN. Native code_quality analysis remains UNVERIFIED; no waiver or complete-analysis claim is made. Normal protected promotion/queue checks remain mandatory. The unrelated retired database is still unhealthy and its retirement has a separate live maintainer holder. This change touches no database, private input, application or route and does not take over that cleanup. The portal stays inactive. The prior-turn API handoff uses the maintainer's standing authorization; no foreign checkout is edited and no local ownership marker is impersonated. |
Blocker: #5412 | upstream | last-verified 2026-10-29: Protected-main verification has recovered: Validate Main 40918750242 succeeded with production convergence and authorization. Actual administration availability is still failing: a fresh browser visit followed the existing Homepage Email/Stalwart tile and received an upstream connection-termination response before login. This supersedes the older successful availability sample; it is not authenticated administration or sustained-readiness proof. Keep this staging repair parked until that exact availability condition is verified. Active #5547 remains separate work; no takeover, duplicate recovery or production mutation was performed. |
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Unparked and evaluated at The branch was brought up to date with
Not proven until it deploys: real admission behaviour. This changes who may write the hold, not the hold's traffic effect, and #5247 keeps that acceptance. |
Why
The public staging application's traffic hold must remain under platform control when the application is enabled. Tenant updates must not silently remove that protection.
What
Reserve the staging hold for the trusted platform controllers while retaining ordinary tenant changes elsewhere. Also prevent an existing reserved policy from being treated as permission for a later tenant update.
Part of #5247