@@ -1,3 +1,5 @@
+{{- /* Render only where the ValidatingAdmissionPolicy API is served (GA since Kubernetes 1.30; the management cluster requires 1.33+). Same guard as packages/core/platform/templates/deletion-protection.yaml. */}}
+{{- if .Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy" }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingAdmissionPolicy
@@ -154,3 +156,4 @@ metadata:
 spec:
   policyName: cozystack-namespace-host-label-policy
   validationActions: [Deny]
+{{- end }}
@@ -57,7 +57,8 @@
   labelling yet — in which case the caller should retry.
 */}}
 {{- $rootHost := index .Values._cluster "root-host" }}
-{{- if $rootHost }}
+{{- /* Also gate on the ValidatingAdmissionPolicy API (GA since Kubernetes 1.30; the management cluster requires 1.33+), so a cluster without it does not get an unrenderable resource. Same guard as packages/core/platform/templates/deletion-protection.yaml. */}}
+{{- if and $rootHost (.Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy") }}
 {{- $A := `namespaceObject.metadata.labels["namespace.cozystack.io/host"]` }}
 {{- $celValidator := printf `(namespaceObject == null || !has(namespaceObject.metadata.labels) || !("namespace.cozystack.io/host" in namespaceObject.metadata.labels)) ? false : (!has(object.spec.defaultBackend) && (!has(object.spec.rules) || object.spec.rules.all(r, has(r.host) && r.host != "" && (r.host == %s || r.host.endsWith("." + %s) || (!r.host.startsWith("*.") && !(r.host == %q || r.host.endsWith(%q)))))) && (!has(object.spec.tls) || object.spec.tls.all(t, !has(t.hosts) || t.hosts.all(h, h != "" && (h == %s || h.endsWith("." + %s) || (!h.startsWith("*.") && !(h == %q || h.endsWith(%q))))))))` $A $A $rootHost (printf ".%s" $rootHost) $A $A $rootHost (printf ".%s" $rootHost) -}}
 ---
 
@@ -36,6 +36,8 @@
   finished labelling yet — in which case the caller should retry.
 */}}
 {{- $celValidator := `(namespaceObject == null || !has(namespaceObject.metadata.labels) || !("namespace.cozystack.io/host" in namespaceObject.metadata.labels)) ? false : (!has(object.spec.hostnames) || object.spec.hostnames.all(h, h == namespaceObject.metadata.labels["namespace.cozystack.io/host"] || h.endsWith("." + namespaceObject.metadata.labels["namespace.cozystack.io/host"])))` -}}
+{{- /* Render only where the ValidatingAdmissionPolicy API is served (GA since Kubernetes 1.30; the management cluster requires 1.33+). Same guard as packages/core/platform/templates/deletion-protection.yaml. */}}
+{{- if .Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy" }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingAdmissionPolicy
@@ -104,3 +106,4 @@ metadata:
 spec:
   policyName: cozystack-route-hostname-policy-tls
   validationActions: [Deny]
+{{- end }}
@@ -19,6 +19,13 @@ release:
 # Both gates are dropped; inheritance now flows via the label
 # selector on Gateway.spec.listeners[].allowedRoutes.
 
+# The template now gates on the ValidatingAdmissionPolicy API (GA since
+# Kubernetes 1.30); helm-unittest's default capability set omits it, so every
+# rendering test declares it, exactly as the platform deletion-protection suite.
+capabilities:
+  apiVersions:
+    - admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy
+
 tests:
   - it: renders 3 VAPs + 3 Bindings (6 documents total)
     asserts:
 
@@ -0,0 +1,30 @@
+suite: cozystack-basics hostname VAP policies are gated on the ValidatingAdmissionPolicy API
+templates:
+  - templates/route-hostname-policy.yaml
+  - templates/gateway-hostname-policy.yaml
+  - templates/ingress-hostname-policy.yaml
+release:
+  name: cozystack-basics
+  namespace: cozy-system
+# root-host is set so the ingress policy's own value gate passes; with it set,
+# the only reason any of these three templates render nothing is the missing
+# ValidatingAdmissionPolicy API declared below. helm-unittest's per-test
+# capabilities merge rather than replace the suite's, so the absent case is a
+# separate suite pinned at suite level (mirrors the platform notes gate suite).
+set:
+  _cluster:
+    root-host: example.org
+capabilities:
+  apiVersions: []
+tests:
+  - it: none of the hostname VAP policies render when the API is unavailable
+    asserts:
+      - hasDocuments:
+          count: 0
+        template: templates/route-hostname-policy.yaml
+      - hasDocuments:
+          count: 0
+        template: templates/gateway-hostname-policy.yaml
+      - hasDocuments:
+          count: 0
+        template: templates/ingress-hostname-policy.yaml
@@ -13,6 +13,13 @@ set:
   _cluster:
     root-host: example.org
 
+# The template now also gates on the ValidatingAdmissionPolicy API (GA since
+# Kubernetes 1.30); helm-unittest's default capability set omits it, so every
+# rendering test declares it, exactly as the platform deletion-protection suite.
+capabilities:
+  apiVersions:
+    - admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy
+
 tests:
   - it: renders ValidatingAdmissionPolicy + Binding for legacy Ingress
     # Legacy Ingress (networking.k8s.io/v1) is the default ingress path
 
@@ -6,6 +6,13 @@ release:
   name: cozystack-basics
   namespace: cozy-system
 
+# The template now gates on the ValidatingAdmissionPolicy API (GA since
+# Kubernetes 1.30); helm-unittest's default capability set omits it, so every
+# rendering test declares it, exactly as the platform deletion-protection suite.
+capabilities:
+  apiVersions:
+    - admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy
+
 tests:
   - it: renders ValidatingAdmissionPolicy + Binding for HTTPRoute and TLSRoute (Layer 7)
     # Layer 7 (route-hostname VAP) is the only VAP rendered by THIS