Repository navigation
docs(kyverno): restate the WebApp child policies for KRO 0.9.4 - #5859
Merged
Merged
Conversation
Both WebApp child admission policies explained themselves in terms of KRO 0.9.2. Re-checked against the 0.9.4 source the platform runs: the apply path still adopts an existing unlabelled object, and deletion now removes every object carrying the parent's ApplySet membership label, with a UID precondition that only guards against a recreate. Both policies are still needed; their headers and the tenant abstraction guide now give today's reasons. Comments only: the rendered policies are unchanged. Fixes #5207 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
@codex review 🤖 Generated with Claude Code |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Contributor
Author
User evaluation, at 🤖 Generated with Claude Code |
Contributor
Author
Status: held as a draft. The Codex review at the current head is clean. This change can't merge yet for two reasons outside it:
Next steps: once #5853 merges, update this branch from 🤖 Generated with Claude Code |
Contributor
✅
|
Contributor
Author
Blocker: none Cleared 2026-11-04: platform#5853 merged 2026-11-04T08:01Z; the organization Go workflow passes on main again and pull requests can pass their required checks (platform#5852 status 2026-11-04) Previous record (historical): |
…-policy-kro-reasons-5207 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
@codex review 🤖 Generated with Claude Code |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
…s use The compiler module pins github.com/kubernetes-sigs/kro v0.9.4, so the paragraph about its generated API tests no longer names 0.9.2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
devantler
commented
Nov 4, 2026
devantler
left a comment
devantler
left a comment
Contributor
Author
There was a problem hiding this comment.
🤖 Generated by the Agentic Engineer (interactive Claude Code session)
Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)
Reviewed commit: c61e03f
- CodeRabbit: rate-limited for this organisation since 2026-11-03 09:04Z (batch lane check); not requested.
- Codex: answered the 2026-11-04 request for this head with its code-review usage-limit message instead of a review.
- Cursor Bugbot: reached its usage limit at 2026-11-04 00:28Z; no review since.
Scope: the whole diff against main at this head (two policy headers and docs/tenant-abstraction.md), including the main merge and the follow-up commit that names the KRO 0.9.4 compiler. I checked that the platform pins KRO 0.9.4 (k8s/bases/infrastructure/controllers/kro/oci-repository.yaml) and that the WebApp compiler module pins github.com/kubernetes-sigs/kro v0.9.4, so every version the change names matches what runs and what the tests compile against. Comments and prose only: kubectl kustomize k8s/bases/infrastructure/cluster-policies renders byte-identically to main, so no admission behaviour changes.
Verdict: no P0/P1 findings
🤖 Generated with Claude Code
Contributor
Author
User evaluation, at 🤖 Generated with Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Two WebApp admission policies explained themselves in terms of KRO 0.9.2. The platform now runs KRO 0.9.4, whose deletion works differently, so a reader could not tell whether either policy was still needed (#5207).
What I checked
I read the KRO
v0.9.4source the platform runs:pkg/controller/instance/applyset/applyset.go,Apply/applyResource): it refuses only an object already labelled for another ApplySet. An existing unlabelled object is force-applied (Force: true) and gains the membership label, so it is adopted.restrict-webapp-child-ownershipis still needed to refuse that.pkg/controller/instance/deletion.go,ListOrphans/DeleteOrphan): no longer by name. It lists every object that carries the parent'sapplyset.kubernetes.io/part-oflabel in the recorded scope, then deletes each one with a UID precondition taken from that same list. The precondition guards only against a recreate between list and delete; a label still does not prove ownership.restrict-webapp-child-deletionstays as defence in depth. The ownership policy already refuses adoption and refuses hand edits of the reserved labels, the two ways a foreign object could gain that membership.What
The two policy headers and the matching paragraphs in
docs/tenant-abstraction.mdnow give these reasons for the version the platform runs. The same page's compiler paragraph now names KRO 0.9.4, the version the WebApp compiler tests pin. No policy is removed, so the offline boundary test is unchanged. These are comments and docs only:kubectl kustomize k8s/bases/infrastructure/cluster-policiesrenders byte-identically tomain.Fixes #5207
🤖 Generated with Claude Code