[devantler]

🤖 Generated by the Agentic Engineer

Why

Kyverno is retiring the validation API used by the UniFi guard. The migration must preserve protection against changes that could delete managed network configuration.

What

Adds equivalent replacement guards and verifies that they preserve the existing admission outcomes. The current guard stays active until the replacements are confirmed ready; its removal follows in a separate protected change.

Part of #5459

[devantler]

🤖 Generated by the Agentic Engineer

Local validation at 89303cd0b33d0b6d372da966a59117c12b662f77 is complete; hosted CI and substantive review are still pending.

• The signed test-only baseline precedes the replacement: all 56 characterized outcomes pass on Kyverno 1.19.1 and 1.19.2. The replacement retains the same literal resource/outcome expectations and loads only its own policy file, so the legacy guard cannot mask a failure.
• The complete current policy suite passes 920 cases; the fixture-evaluation guard validates all 99 test files. Six replacement ablations (three protections on both versions) cause actual expected-outcome failures. The six earlier legacy ablations also failed as expected.
• The existing prune/retention regression passes. Three further controls independently mispair a replacement's resource and API group; each is rejected by the scope guard. ShellCheck, the repository's shell formatting and the policy-action tests pass; all 53 explicit failure actions match both source and rendered production manifests.
• All ten manifest layers build. Both provider payloads contain the unchanged legacy guard and all three replacements. Both static KSail validations pass, with the existing chart-fetch and offline namespace-label warnings retained; those warnings are not represented as full chart-render or live-admission proof.

This is the additive phase of #5459. The legacy policy is unchanged and remains enforced. After normal protected delivery I will bind the live replacement readiness to the published source before proposing its removal. The issue remains open until that removal and its runtime verification are complete.

[devantler]

🤖 Generated by the Agentic Engineer

The first hosted run correctly rejected my combined policy file: this repository requires one Kubernetes resource per file. Corrected at 801be602a9727bf20f2272cb08b2414d3195c385 by splitting the three replacements into individually named files. The legacy policy remains unchanged; no naming exception or validation suppression was added.

The exact hosted naming-validator revision now passes locally. The complete policy suite still passes all 920 outcomes and all 99 fixture files satisfy the evaluation guard. Both CLI versions retain the characterized results; the six weakened-policy controls and three independent group/resource-pair controls still fail as intended. All 53 approved failure actions match source and rendered production policies. Both static configurations and all ten manifest layers validate, with the previously recorded offline warnings retained.

This head also includes the independently validated protected-release change from current main. Fresh native CI is 40584911484; review and runtime acceptance remain pending.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 24 minutes.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 24 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: devantler-tech/platform
• Branch: codex/unifi-validation-5459-r69
• File: .coderabbit.yaml
• Commit: 801be60
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 3232acc9-19dd-42c5-96ad-fa61de0abde2

Commits

Reviewing files that changed from the base of the PR and between efd74cd and 801be60.

Files selected for processing: 14

• k8s/bases/infrastructure/cluster-policies/best-practices/restrict-unifi-apply-management-policies.yaml
• k8s/bases/infrastructure/cluster-policies/best-practices/restrict-unifi-observe-only.yaml
• k8s/bases/infrastructure/cluster-policies/best-practices/restrict-unifi-prune-management-policies.yaml
• k8s/bases/infrastructure/cluster-policies/kustomization.yaml
• scripts/tests/test-flux-kustomization-prune.sh
• tests/policy-failure-actions.json
• tests/restrict-unifi-management-policies-apply/kyverno-test.yaml
• tests/restrict-unifi-management-policies-apply/resources.yaml
• tests/restrict-unifi-management-policies-delete/kyverno-test.yaml
• tests/restrict-unifi-management-policies-delete/resources.yaml
• tests/restrict-unifi-management-policies-other-identity-delete/kyverno-test.yaml
• tests/restrict-unifi-management-policies-other-identity/kyverno-test.yaml
• tests/restrict-unifi-management-policies-update/kyverno-test.yaml
• tests/restrict-unifi-management-policies-update/values.yaml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T22:04:48.383068Z	801be60	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 801be602a9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness rechecked at 801be602a9727bf20f2272cb08b2414d3195c385: native CI 40584911484 succeeded; all 47 reported contexts are settled (36 successful, 10 intentionally skipped, one neutral), and Codex completed its review at that head with no findings or unresolved threads. Production health is healthy.

Operator evaluation used the real Kyverno 1.19.2 CLI against the replacement policies alone. CREATE requests produced four allowed and nine denied cases; DELETE requests produced two allowed and five denied cases, with zero evaluation errors. These expected denials independently demonstrate the policy outcomes. The full 920-case suite, both supported CLI versions for the focused cases, six guard-removal controls, exact scope controls, rendered layers and naming checks also passed.

The native code-quality rule has no readable per-head analysis surface, so its independent audit remains UNVERIFIED; the normal protected merge API must enforce it. No bypass is requested. This is the additive stage only: the original policy stays deployed until all three replacements are observed ready, followed by a separately reviewed removal. #5459 remains open through that final verification.