🤖 Generated by the Agentic Engineer
Evidence
Kyverno's own v1 CRD, as installed on the cluster (v1.18.2), describes the spec-level field as:
Deprecated, use validationFailureAction under the validate rule instead.
Current usage in k8s/bases/infrastructure/cluster-policies/:
| Form |
Count |
spec.validationFailureAction (deprecated) |
11 |
spec.rules[].validate.failureAction (current) |
1 — restrict-homepage-service-groups, added by #3173 |
Impact
Not broken today. The deprecated field is still honoured on v1.18.2 — verified against the live
cluster: clusterpolicy/restrict-tenant-route-hostnames retains spec.validationFailureAction: Enforce and reports Ready: True with 4 validate rules. This is deprecation debt, not an outage.
What it costs is a mixed codebase: eleven policies in the old form and one in the new. The risk is
the field being removed in a future Kyverno major, which would silently drop every affected policy to
its default action rather than failing loudly — the same silent-degradation shape the new policy was
written to prevent.
Expected behaviour
Every ClusterPolicy expresses its failure action per-rule via validate.failureAction, with
policies.kyverno.io/minversion at 1.13.0 or later.
Acceptance criteria
Size
Small-to-medium and mechanical, but it touches every policy at once, so it wants its own PR rather
than riding along with a feature change.
Notes
Raised by CodeRabbit on #3173, which introduced the first policy in the modern form. Refuted there as
out of scope for that PR: the new policy adopts validate.failureAction so it adds no new debt, and
migrating the other eleven is this issue.
Evidence
Kyverno's own v1 CRD, as installed on the cluster (v1.18.2), describes the spec-level field as:
Current usage in
k8s/bases/infrastructure/cluster-policies/:spec.validationFailureAction(deprecated)spec.rules[].validate.failureAction(current)restrict-homepage-service-groups, added by #3173Impact
Not broken today. The deprecated field is still honoured on v1.18.2 — verified against the live
cluster:
clusterpolicy/restrict-tenant-route-hostnamesretainsspec.validationFailureAction: Enforceand reportsReady: Truewith 4 validate rules. This is deprecation debt, not an outage.What it costs is a mixed codebase: eleven policies in the old form and one in the new. The risk is
the field being removed in a future Kyverno major, which would silently drop every affected policy to
its default action rather than failing loudly — the same silent-degradation shape the new policy was
written to prevent.
Expected behaviour
Every
ClusterPolicyexpresses its failure action per-rule viavalidate.failureAction, withpolicies.kyverno.io/minversionat1.13.0or later.Acceptance criteria
grep -rl '^ validationFailureAction:' k8s/bases/infrastructure/cluster-policies/returns nothing.EnforcevsAudit) — this is amechanical rename, not a posture change.
kyverno test ./testsstays green.Readyafter rollout, and a known-violating fixture is still denied.Size
Small-to-medium and mechanical, but it touches every policy at once, so it wants its own PR rather
than riding along with a feature change.
Notes
Raised by CodeRabbit on #3173, which introduced the first policy in the modern form. Refuted there as
out of scope for that PR: the new policy adopts
validate.failureActionso it adds no new debt, andmigrating the other eleven is this issue.