[devantler]

🤖 Generated by the Agentic Engineer

Why

The replacement UniFi guards are deployed and ready, but the old policy still remains. Completing the retirement removes the deprecated policy while preserving safe network management.

What

Keep the three replacement guards, align access with the existing supported resources, and retain checks that catch gaps in their coverage.

Part of #5459

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 47 minutes.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 47 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: devantler-tech/platform
• Branch: codex/unifi-legacy-retirement-5459-r69
• File: .coderabbit.yaml
• Commit: 63482a9
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 743fc5ed-c3df-49eb-8936-769c82dd7cb6

Commits

Reviewing files that changed from the base of the PR and between e571378 and 63482a9.

Files selected for processing: 7

• docs/unifi-management.md
• k8s/bases/infrastructure/cluster-policies/best-practices/restrict-unifi-management-policies.yaml
• k8s/bases/infrastructure/cluster-policies/kustomization.yaml
• k8s/providers/hetzner/apps/unifi/flux-kustomization.yaml
• k8s/providers/hetzner/apps/unifi/role.yaml
• scripts/tests/test-flux-kustomization-prune.sh
• tests/policy-failure-actions.json

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T02:35:09.208393Z	3c6c305	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 63482a9164

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 3c6c305bc4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

The staged replacements from #5462 are deployed: all three report Ready with configured webhooks and granted reporting permissions. Its native merge-group run 40612624080 succeeded at the final merged commit; the published artifact and live source revision agree.

This retirement retains those replacements and their existing deny behavior. The access rules now name the existing supported resource pairs individually. The production-authorization evaluator generated exactly one changed approval entry, and its complete package regressions and repository-root validation pass after that reviewed update. No validator rule was relaxed.

Local acceptance passed all 920 Kyverno cases with 1.19.2 and the 56 focused compatibility cases with 1.19.1. The pruning/retention regression, including nine scope mutations, passed. All ten Flux layers render; source and rendered failure-action checks pass with the three retired entries removed. Both schema runs validated 753 files, retaining 20 Helm-render skips caused by the unavailable local credential helper and three offline namespace-label warnings. Those limitations are not runtime or complete Helm acceptance; hosted validation remains required.

The policy remains open in #5459 until this separate removal merges, deploys, and live readback proves the legacy guard absent and all replacements Ready. Current source: 3c6c305.

[devantler]

🤖 Generated by the Agentic Engineer

Ready at 3c6c305: all 47 native contexts are settled (36 successful, 11 intentionally skipped). Codex receipt 6459096790 reviews this head without findings, and there are no unresolved threads. The body contract passes, the source commit is verified, and this session owns the worktree.

The separate staged replacement is deployed and all three guards report Ready. The complete local policy and compatibility suites, direct scope mutations, layer renders, failure-action validation and production-authorization regressions pass as recorded above. Hosted manifest and guard checks now pass too. The approval record changes exactly the intended access entry; no validator was relaxed.

Required checks and workflows pass. Code Quality is configured but has no independently readable head verdict; normal native protection and the merge queue remain in force. Platform's health check passes. Keep #5459 open until the queue deploys this removal and readback proves the old policy absent and every replacement Ready.