feat(kyverno): unregister the classic auto-vpa ClusterPolicy

[devantler]

🤖 Generated by the Agentic Engineer

Why

The platform's automatic sizing policy uses a policy form that the next policy-engine release removes. The shared policy library already ships the replacement, and the library's rollout guide moves a cluster across in two separate deploys, so that the old and new policies never run at the same time and no workload ends up with two competing sizing rules.

What

This first deploy stops the old sizing policy, which removes the sizing rules it created for about 88 workloads. Running pods keep their current, already-resized limits; only a pod that restarts before the second deploy lands comes back at its authored size. The old policy stays in the repository, still tested, as the rollback form.

Part of #5130

⚠️ Merge order: merge this first, confirm in production that none of the old policy's sizing rules remain, then merge the follow-up that registers the shared policy straight away. The gap between the two should stay as short as possible, because several controllers (the delivery pipeline's own among them) run well above their authored memory limits today.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d69daae7-a1cf-4f8e-a52e-2e0c316e59c3

📥 Commits

Reviewing files that changed from the base of the PR and between f67064f and 118eb08.

📒 Files selected for processing: 1

• k8s/bases/infrastructure/cluster-policies/kustomization.yaml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

📚 Code guidelines: 1

AGENTS.md — auto-discovered

📓 Path-based instructions: 2

Source excerpt: Resources under `k8s/bases/infrastructure/` are **component-folder-first**: a component's HelmRelease/HelmRepository and its own CRs live together in a folder named after the component — `controllers//` in the con...

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• k8s/bases/infrastructure/cluster-policies/kustomization.yaml

Source excerpt: **Put a change in the layer that matches its scope** — edit `k8s/bases/` when it should hold for **every consumer of that resource**; add an overlay `patches/` fragment only for a genuine per-consumer difference.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• k8s/bases/infrastructure/cluster-policies/kustomization.yaml

🔇 Additional comments: 1

k8s/bases/infrastructure/cluster-policies/kustomization.yaml: 1

11-17: LGTM!

📝 Walkthrough

The cluster policies Kustomization no longer registers best-practices/auto-vpa.yaml. Comments state that the file remains available as a rollback form until the GeneratingPolicy migration is complete and generated VPAs have been removed.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 118eb

The change is mergeable as the documented first migration step, with rollback availability retained.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: unregistering the classic Kyverno auto-vpa ClusterPolicy.
Description check		The description directly explains the migration step, its operational impact, rollback form, and required merge order.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at 118eb0817a5e555d4c88f8e378eadcc84739864d:

• CI: green (29 pass, 9 path-skipped).
• Review: CodeRabbit full review at this head found no actionable comments. 0 review threads.
• User evaluation: I diffed the rendered Hetzner infrastructure layer against the pre-change render. The only object removed is ClusterPolicy/auto-vpa; nothing else changes. Both ksail workload validate runs (local and prod) pass. So do tests/auto-vpa (4/4), the fixture-evaluation self-test and the consumer-discovery guard.
• Live pre-state, read-only: Kyverno is 1.19.1, and 88 VPAs are labelled generate.kyverno.io/policy-name=auto-vpa. These go away when this deploys. Running pods keep their in-place-resized limits.

Post-deploy check: 0 VPAs with that label. Then step 2 (#5134) merges straight away. Its CI is running, Codex's three findings are refuted with live evidence, and it waits on one green review.

Promoting and queueing.