Myasnikov Daniil 0c17d1870c feat(platform): add deletion-protection guardrail via ValidatingAdmissionPolicy ...

Block accidental DELETE on critical platform objects (tenant-root,
cozy-system, LinstorCluster, CRDs, ClusterIssuers, cozystack-version
ConfigMap, cozystack-packages OCIRepository, tenant-root HelmRelease)
via a label-scoped ValidatingAdmissionPolicy. No webhook DaemonSet,
Service, TLS, or image — the API server evaluates the CEL expression
in-process. Requires Kubernetes 1.30+.

Bypass for legitimate deletes is two steps:
  kubectl label <kind> <name> platform.cozystack.io/no-delete-
  kubectl delete <kind> <name>

CRDs installed dynamically by the operator get the label stamped in
internal/crdinstall/install.go before the apply call.

Release note:
Added deletion-protection guardrail (ValidatingAdmissionPolicy) blocking
DELETE on cozystack platform objects labeled platform.cozystack.io/no-delete=true.
Bypass by removing the label first.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

2026-05-26 14:18:22 +05:00

..

application-definition-crd

refactor(api): rename CozystackResourceDefinition to ApplicationDefinition

2026-01-15 22:35:56 +01:00

backup-controller

refactor(build): standardize image tagging to fix concurrent PR push conflicts

2026-05-21 15:23:18 +05:00

backupstrategy-controller

refactor(build): standardize image tagging to fix concurrent PR push conflicts (#2711)

2026-05-25 22:16:57 +05:00

bootbox

refactor(labels): remove cozystack.io/ui label

2026-01-19 13:59:29 +01:00

bootbox-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

bucket

feat(networking): Gateway API support via Cilium (supersedes #2213) (#2470)

2026-05-26 10:29:30 +03:00

bucket-rd

fix(bucket): regenerate schema and docs from values.yaml annotations

2026-03-03 19:32:32 +03:00

capi-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

capi-providers-bootstrap

fix(cluster-api): fix kamaji OOM and set limits on unset providers

2026-05-21 12:57:02 +05:00

capi-providers-core

fix(cluster-api): fix kamaji OOM and set limits on unset providers

2026-05-21 12:57:02 +05:00

capi-providers-cpprovider

fix(cluster-api): fix kamaji OOM and set limits on unset providers

2026-05-21 12:57:02 +05:00

capi-providers-infraprovider

fix(cluster-api): fix kamaji OOM and set limits on unset providers

2026-05-21 12:57:02 +05:00

cert-manager

fix(cert-manager): bump chart to v1.20.2

2026-05-03 20:49:47 +05:00

cert-manager-crds

fix(cert-manager): bump chart to v1.20.2

2026-05-03 20:49:47 +05:00

cert-manager-issuers

feat(platform): add deletion-protection guardrail via ValidatingAdmissionPolicy

2026-05-26 14:18:22 +05:00

cilium

feat(networking): Gateway API support via Cilium (supersedes #2213) (#2470)

2026-05-26 10:29:30 +03:00

cilium-networkpolicy

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

clickhouse-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

clickhouse-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

cluster-autoscaler

feat(cluster-autoscaler): enable enforce-node-group-min-size by default

2026-02-14 11:42:52 +01:00

clustersecret-operator

Add clustersecret-operator system package

2026-02-10 22:47:20 +05:00

coredns

fix(coredns): sanitize Chart.Version build metadata in coredns-custom label

2026-05-07 16:45:36 +03:00

cozy-proxy

feat(cozy-proxy): bump to v0.3.0

2026-04-28 11:14:27 +02:00

cozystack-api

feat(networking): Gateway API support via Cilium (supersedes #2213) (#2470)

2026-05-26 10:29:30 +03:00

cozystack-basics

feat(platform): add deletion-protection guardrail via ValidatingAdmissionPolicy

2026-05-26 14:18:22 +05:00

cozystack-controller

feat(networking): Gateway API support via Cilium (supersedes #2213) (#2470)

2026-05-26 10:29:30 +03:00

cozystack-scheduler

feat(scheduler): storage-aware scheduling

2026-04-13 17:15:09 +03:00

dashboard

feat(networking): Gateway API support via Cilium (supersedes #2213) (#2470)

2026-05-26 10:29:30 +03:00

etcd-operator

feat(platform): add implementation of backup-strategy controller for etcd

2026-05-22 14:35:08 +04:00

etcd-rd

feat(platform): add implementation of backup-strategy controller for etcd

2026-05-22 14:35:08 +04:00

external-dns

feat(extra): add external-dns as standalone extra package

2026-03-10 12:48:01 +01:00

external-dns-rd

ci(external-dns): regenerate cozyrds schema for gatewayAPI description

2026-05-25 19:11:52 +03:00

external-secrets-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

flux-plunger

fix(flux-plunger): correct common-envs.mk include path

2026-05-25 17:45:44 +05:00

fluxcd

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

fluxcd-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

foundationdb-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

foundationdb-rd

feat(platform): add implementation of backup-strategy controller for foundationdb

2026-05-13 09:49:19 +04:00

gateway-api-crds

feat: Gateway API support via Cilium

2026-05-25 17:07:02 +03:00

goldpinger

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

gpu-operator

test(gpu-operator): assert variant overlays render expected ClusterPolicy

2026-04-30 14:52:56 +03:00

grafana-operator

refactor(build): standardize image tagging to fix concurrent PR push conflicts

2026-05-21 15:23:18 +05:00

hami

chore(hami): document and partially automate vendor patches in Makefile

2026-04-29 11:14:41 +03:00

harbor

test(harbor): add helm-unittest coverage for bucket-secret guards

2026-04-30 16:40:26 +05:00

harbor-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

hetzner-robotlb

chore(hetzner-robotlb): update robotlb chart to appVersion 0.0.6

2026-04-23 16:57:23 +05:00

http-cache-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

info-rd

refactor(labels): remove cozystack.io/ui label

2026-01-19 13:59:29 +01:00

ingress-nginx

Replaced direct chart edits with patch files

2026-03-02 12:35:14 +05:00

ingress-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

kafka-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

kafka-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

kamaji

refactor(build): standardize image tagging to fix concurrent PR push conflicts

2026-05-21 15:23:18 +05:00

keycloak

feat: Gateway API support via Cilium

2026-05-25 17:07:02 +03:00

keycloak-configure

chore(keycloak): use generic example values in chart comments

2026-05-12 13:13:19 +05:00

keycloak-operator

refactor(build): standardize image tagging to fix concurrent PR push conflicts

2026-05-21 15:23:18 +05:00

kilo

refactor(build): standardize image tagging to fix concurrent PR push conflicts

2026-05-21 15:23:18 +05:00

kubeovn

fix(kube-ovn): bump kube-ovn to v1.15.10 with port-group regression fix

2026-04-21 20:09:19 +02:00

kubeovn-plunger

refactor(build): standardize image tagging to fix concurrent PR push conflicts

2026-05-21 15:23:18 +05:00

kubeovn-webhook

refactor(build): standardize image tagging to fix concurrent PR push conflicts

2026-05-21 15:23:18 +05:00

kubernetes-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

kubevirt

feat: Gateway API support via Cilium

2026-05-25 17:07:02 +03:00

kubevirt-cdi

feat: Gateway API support via Cilium

2026-05-25 17:07:02 +03:00

kubevirt-cdi-operator

[cdi-operator] Update to v1.64.0

2026-02-20 20:16:33 +01:00

kubevirt-csi-node

Prepare release v1.4.0-rc.2

2026-05-13 21:48:39 +00:00

kubevirt-instancetypes

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

kubevirt-operator

fix(kubevirt-operator): move PrometheusRule to Helm-rendered template (#2543)

2026-05-04 20:38:44 +02:00

lineage-controller-webhook

refactor(build): standardize image tagging to fix concurrent PR push conflicts

2026-05-21 15:23:18 +05:00

linstor

feat(platform): add deletion-protection guardrail via ValidatingAdmissionPolicy

2026-05-26 14:18:22 +05:00

linstor-gui

refactor(build): standardize image tagging to fix concurrent PR push conflicts

2026-05-21 15:23:18 +05:00

linstor-scheduler

feat(scheduler): storage-aware scheduling

2026-04-13 17:15:09 +03:00

local-ccm

Update local-ccm v0.3.0

2026-02-10 20:19:03 +01:00

mariadb-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

mariadb-rd

feat(platform): implement backup strategy for mariadb

2026-05-12 13:56:29 +04:00

metallb

refactor(build): standardize image tagging to fix concurrent PR push conflicts

2026-05-21 15:23:18 +05:00

metrics-server

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

mongodb-operator

Fix pre-commit check

2026-01-20 03:24:32 +01:00

mongodb-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

monitoring

feat(networking): Gateway API support via Cilium (supersedes #2213) (#2470)

2026-05-26 10:29:30 +03:00

monitoring-agents

fix(monitoring): prevent many-to-many match in util-per-watt recording rule

2026-04-28 11:21:12 +03:00

monitoring-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

multus

refactor(build): standardize image tagging to fix concurrent PR push conflicts

2026-05-21 15:23:18 +05:00

nats

Add monitoring for NATs

2026-02-17 22:54:12 +01:00

nats-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

nfs-driver

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

objectstorage-controller

refactor(build): standardize image tagging to fix concurrent PR push conflicts

2026-05-21 15:23:18 +05:00

openbao

feat(openbao): add system chart with vendored upstream

2026-02-17 20:03:01 +03:00

openbao-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

opencost

Fix pre-commit check

2026-01-20 03:24:32 +01:00

opensearch-operator

fix(opensearch-operator): use values.yaml override instead of patch

2026-05-20 15:45:08 +05:00

opensearch-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

ouroboros

feat(ouroboros): bump to v0.7.2 with debug logging on tenants

2026-05-11 02:20:34 +03:00

piraeus-operator

[piraeus-operator] Split LINSTOR controller availability and metrics alerts

2026-03-25 16:11:14 +03:00

piraeus-operator-crds

Move CRDs installation logic to piraeus-operator-crds chart

2026-02-11 22:54:56 +01:00

postgres-operator

docs(postgres-operator): fix backoffLimit/activeDeadlineSeconds comment math

2026-04-24 13:33:07 +03:00

postgres-rd

fix(postgres): drive postgresql.parameters int-or-string from the generator

2026-05-21 16:04:07 +05:00

prometheus-operator-crds

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

qdrant

[qdrant] Add Qdrant vector database application

2026-02-06 13:30:58 +03:00

qdrant-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

rabbitmq-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

rabbitmq-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

redis-operator

refactor(build): standardize image tagging to fix concurrent PR push conflicts

2026-05-21 15:23:18 +05:00

redis-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

reloader

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

seaweedfs

Prepare release v1.4.0-rc.2

2026-05-13 21:48:39 +00:00

seaweedfs-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

snapshot-controller

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

tcp-balancer-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

telepresence

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

tenant-rd

feat: Gateway API support via Cilium

2026-05-25 17:07:02 +03:00

velero

fix(backups): move velero-configmap Role to velero chart

2026-04-23 10:41:41 +05:00

vertical-pod-autoscaler

Post upgrade fixes for v1.0 packagesources

2026-01-28 20:08:35 +03:00

vertical-pod-autoscaler-crds

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

victoria-metrics-operator

feat(monitoring): upgrade victoria-metrics-operator to v0.68.4

2026-04-20 15:48:53 +03:00

virtualprivatecloud-rd

[docs] Update cozyvalues-gen

2026-03-25 15:59:22 +05:00

vm-default-images

[vm-default-images] Default to replicated storageClass and document storage requirements

2026-04-14 19:59:20 +05:00

vm-disk-rd

[vm-disk] Fix vm-disk-rd

2026-04-14 19:59:19 +05:00

vm-instance-rd

[vm-instance] Add externalAllowICMP knob, drop in-PR changelog

2026-04-28 08:37:13 +02:00

vpn-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

vsnap-crd

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

Makefile

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00