fix(guards): admit a system-namespace exclusion on the reviewed auto-vpa GeneratingPolicy

[devantler]

🤖 Generated by the Agentic Engineer

Why

The platform is moving its automatic resource-sizing policy to the shared catalog's newer form before the next policy-engine upgrade removes the old one. The platform must keep that policy out of four system namespaces, where it already sizes controllers another way; without the exclusion, those controllers would get two competing sizing rules. The safety checks refuse the shared policy as soon as the exclusion is added.

What

The safety checks now also accept the shared sizing policy when it carries a list of namespaces to skip. Only a plain "skip these named namespaces" list is allowed; selecting namespaces, matching on other labels, empty lists, or filtering workloads by label are still refused, with a test for each. Nothing deployed changes in this pull request; switching the policy over is the next step.

Fixes #5125

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 41 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 854dbf8d-2f13-46c8-9647-44e05f77e955

📥 Commits

Reviewing files that changed from the base of the PR and between 610b817 and 24d75e4.

📒 Files selected for processing: 4

• scripts/guard-consumer-discovery-conservation.sh
• scripts/tests/crossplane-egress-policy-rules.yaml
• scripts/tests/test-crossplane-egress-policy.sh
• scripts/tests/test-guard-consumer-discovery-conservation.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)

Reviewed commit: ea10b3b39c1693f2e29b9f57def40aaeb35c75fe

• CodeRabbit: rate limited — its reply to the 11:42Z request at the previous head says the free OSS review limit is used up, next review in ~41 minutes; no CodeRabbit review exists on this PR.
• Codex: usage limit since 2026-10-19 22:44Z (lane-health read 11:12Z today); no Codex artifact on this PR.
• Cursor Bugbot: usage limit since 2026-10-19 22:18Z (lane-health read 11:12Z today); no Bugbot check-run on this PR.

Scope read: the whole diff against main, plus an independent read-only review pass over both guards. Ran both suites locally at this head: the bash guard's suite (0 failures, 9 new negative controls) and the egress-rule suite (PASS, 6 new cases on Kyverno CLI). Control run: with the old rule file the egress suite fails on exactly the new accept case, so the test exercises the change.

Correctness: both guards accept the catalog policy with or without the selector and refuse matchLabels, In/Exists, another label key, empty expression or value lists, and an objectSelector. On the bash side a non-map element makes yq fail and the guard refuses ("could not read"), which fails closed; null, aliases and merge keys are refused by the type and key checks. On the CEL side a non-string value or an extra expression field is rejected by the CRD schema before the rule runs, so those two cases are tested on the bash side only. CI at the previous head was all green.

Security: the only newly admitted field is a namespace label selector that can only exclude named namespaces. It is not CEL, so it cannot read or write the cluster or change what is generated, and the generated object stays the reviewed VerticalPodAutoscaler. No production manifest changes.

Nits (not blocking): the CEL side raises an evaluation error rather than returning false on a null or list-typed selector. The existing branch already behaves that way for other fields, and the CRD schema rejects those shapes first.

Verdict: no P0/P1 findings

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at ea10b3b39c1693f2e29b9f57def40aaeb35c75fe

• CI: all required checks green at this head (29 pass, 9 skipped by path).
• Review: fallback self-review GREEN at this head (CodeRabbit rate limited, Codex and Bugbot at their usage limit); 0 review threads; no non-thread findings.
• User evaluation: in my own worktree I swapped the classic auto-vpa for the catalog's three GeneratingPolicy objects, each with the system-namespace exclusion, and ran the real guard over the production render. With this branch's guard it passed (5 consumers match the render exactly). With main's guard it refused the same render ("unevaluated CEL admission mutation or generation"). The egress-rule suite fails on the new accept case with the old rule file and passes with the new one. The tree was restored afterwards; nothing deployed changes in this PR.
• Next: under feat(policy): migrate generate rules to GeneratingPolicy kyverno-policies#1, remove the classic policy in one reconcile, then add the catalog policies with this exclusion in the next.