[sandert-k8s]

Old policy types are officially deleted in Kyverno since 1.20; which is released yesterday. Migrate everything to the new policytypes.

[netlify]

👷 Deploy request for docs-projectcapsule pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	0c1c151

[Copilot]

🟡 Changes recommended

The review found an issue that should be addressed before approval.

3 open issues

• Reject storage classes absent from the Tenant allowlist · New
• Match PDB selectors using both matchLabels and matchExpressions · New
• Fetch the named ClusterIssuer instead of listing all issuers · New

What changed in this PR

This PR migrates Capsule’s admission-policy examples to Kyverno’s newer policy APIs, retaining guidance for securing multi-tenant clusters.

Changes:

• Replaces legacy ClusterPolicy examples with CEL-based ValidatingPolicy and MutatingPolicy definitions.
• Updates resource matching, validation, mutation, and exception handling.
• Adds read-permission guidance for resource lookups and clarifies background scanning.

File	Description
content/​en/​docs/​operating/​best-practices/​admission-policies.md	Migrates Kyverno examples for tenant classes, workloads, and certificates to the new policy types.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The documented policies can admit eviction-blocking disruption budgets, deny unrelated ObjectBucketClaims, and mutate Pod controllers despite the intended Pod-only scope.

1 open issue

• StorageClass example requires a matching Tenant condition · New

4 previously missed issues

In code that hasn't changed since last review

Missing Tenant status can deny unrelated ObjectBucketClaims

content/​en/​docs/​operating/​best-practices/​admission-policies.md:85

A newly created Tenant without a status field makes t.status.?namespaces fail the entire filter, so ObjectBucketClaims for unrelated Tenants can be denied too. Resolve the Tenant directly from the namespace's capsule.clastix.io/tenant label and make the status lookup optional; that also avoids the deprecated status.namespaces field (content/en/docs/reference.md:11793).

Percentage minAvailable values bypass the eviction-safety check

content/​en/​docs/​operating/​best-practices/​admission-policies.md:266

The type(...) != int branch accepts every percentage-valued minAvailable without checking the matching Deployments. For example, minAvailable: "100%" with a three-replica Deployment passes, even though it requires all three Pods to remain available and prevents voluntary evictions—the condition this policy is intended to reject. Please evaluate percentages using Kubernetes' round-up semantics rather than bypassing the comparison for strings.

Legacy annotation does not disable Pod-controller autogen

content/​en/​docs/​operating/​best-practices/​admission-policies.md:358

The legacy annotation is ignored by MutatingPolicy, so it does not keep this mutation Pod-only. With autogen left at its default, Kyverno also generates mutations for supported Pod controllers, including Deployments and Jobs. Replace the annotation with spec.autogen.podControllers.enabled: false.

Reports controller lacks Gateway read permissions

content/​en/​docs/​operating/​best-practices/​admission-policies.md:510

Background scans run in Kyverno's reports controller, but the values below grant Gateway access only to the admission controller. If Gateway read permissions are otherwise missing, enabling background evaluation as instructed still leaves existing Gateways unscanned. Please grant these permissions under reportsController.rbac.clusterRole.extraResources instead.

3 resolved since last review

• Match PDB selectors using both matchLabels and matchExpressions
• Reject storage classes absent from the Tenant allowlist
• Fetch the named ClusterIssuer instead of listing all issuers

_{Review effort: Max}

[Copilot]

🟡 Changes recommended

Unresolved policy defects can block Pod finalizer removal, deny claims for unrestricted Tenants, and miscalculate disruption allowances, while several integration examples remain unmigrated.

1 open issue

• Calculate PDB percentages using all selected controllers' replicas · New

3 previously missed issues

In code that hasn't changed since last review

Limit the size-limit policy to Pod creation

content/​en/​docs/​operating/​best-practices/​admission-policies.md:369

For a Pod created before this policy was installed without an emptyDir.sizeLimit, a later metadata update adds the limit to that existing Pod. Kubernetes rejects that immutable spec.volumes change, which can block finalizer removal and leave Pods terminating. Match CREATE only.

Migrate remaining Kyverno examples to the supported policy API

content/​en/​docs/​operating/​best-practices/​admission-policies.md:9

The repository-wide migration described in the PR is incomplete: content/en/ecosystem/integrations/kyverno.md still contains five kyverno.io/v1 ClusterPolicy examples (starting at lines 56, 91, 163, 244, and 311), and content/en/ecosystem/integrations/monitoring.md contains another at line 74. Readers following those integration guides will still be instructed to apply the policy type that this paragraph says Kyverno 1.20 rejects. Please migrate those remaining examples as well.

Skip bucket validation for Tenants without storage-class conditions

content/​en/​docs/​operating/​best-practices/​admission-policies.md:86

The selector matches all Tenant namespaces, so an unrestricted Tenant's missing status.classes.storage becomes [] and every ObjectBucketClaim create or update is denied. The warning at line 43 does not scope the policy, and this can also prevent finalizer removal. Fetch the Tenant once and bypass validation when no storage-class matching condition is configured; adjust that warning to match.

1 resolved since last review

• StorageClass example requires a matching Tenant condition

_{Review effort: Max}

[Copilot]

🟡 Changes recommended

Critical policy gaps permit cross-tenant deployments and log routing, while incorrect handling of optional owners and unrestricted storage configurations can reject valid resources.

4 open issues

• Kustomizations without targetNamespace can target another Tenant · New
• Optional owners cause defaulting to fail · New
• User-controlled Pod label permits cross-tenant log routing · New
• Empty storage class configuration denies all claims · New

1 resolved since last review

• Calculate PDB percentages using all selected controllers' replicas

_{Review effort: Max}

[Copilot]

🟡 Changes recommended

The Kyverno policy’s error message obscures a missing spec.targetNamespace instead of telling users to set the field.

1 open issue

• Explain missing targetNamespace when the target namespace is empty · New

4 resolved since last review

• User-controlled Pod label permits cross-tenant log routing
• Optional owners cause defaulting to fail
• Kustomizations without targetNamespace can target another Tenant
• Empty storage class configuration denies all claims

_{Review effort: Max}