Skip to content

Commit b49ee24

Browse files
lexfreilexfrei
committed
fix(cozystack-basics): gate gateway-hostname-policy with matchConditions
Address review feedback from kitsunoff on packages/system/cozystack-basics/templates/gateway-hostname-policy.yaml:22: the first VAP had no matchConditions, so with failurePolicy: Fail and a validation expression of variables.tenantHost != "", any Gateway in a namespace without the namespace.cozystack.io/host label (kube-system, default, any non-cozystack namespace) was rejected cluster-wide, including clusters running with gateway.enabled: false. Hoist the namespace-label precondition into matchConditions so the VAP only fires for cozystack-managed tenant namespaces, then simplify the validation body — the explicit tenantHost-nonempty check becomes redundant. Assisted-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>
1 parent fc86269 commit b49ee24

1 file changed

Lines changed: 13 additions & 12 deletions

File tree

‎packages/system/cozystack-basics/templates/gateway-hostname-policy.yaml‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -20,22 +20,23 @@ spec:
2020
apiVersions: ["v1", "v1beta1"]
2121
operations: ["CREATE", "UPDATE"]
2222
resources: ["gateways"]
23+
matchConditions:
24+
- name: is-cozystack-managed-namespace
25+
expression: >-
26+
has(namespaceObject.metadata.labels) &&
27+
"namespace.cozystack.io/host" in namespaceObject.metadata.labels &&
28+
namespaceObject.metadata.labels["namespace.cozystack.io/host"] != ""
2329
variables:
2430
- name: tenantHost
25-
expression: >-
26-
(has(namespaceObject.metadata.labels) &&
27-
has(namespaceObject.metadata.labels["namespace.cozystack.io/host"]))
28-
? namespaceObject.metadata.labels["namespace.cozystack.io/host"]
29-
: ""
31+
expression: 'namespaceObject.metadata.labels["namespace.cozystack.io/host"]'
3032
validations:
3133
- expression: >-
32-
variables.tenantHost != "" &&
33-
(!has(object.spec.listeners) ||
34-
object.spec.listeners.all(l,
35-
!has(l.hostname) ||
36-
l.hostname == variables.tenantHost ||
37-
l.hostname.endsWith("." + variables.tenantHost)
38-
))
34+
!has(object.spec.listeners) ||
35+
object.spec.listeners.all(l,
36+
!has(l.hostname) ||
37+
l.hostname == variables.tenantHost ||
38+
l.hostname.endsWith("." + variables.tenantHost)
39+
)
3940
messageExpression: >-
4041
"Gateway listener hostname must equal " + variables.tenantHost +
4142
" or end with ." + variables.tenantHost +

0 commit comments

Comments
 (0)