Restore protect-builtin-tiers.yaml

[pasanw]

Description

The operator doesn't carry Calico's admission policies by hand — at release time a script wipes its pkg/imports/admission/calico/ directory and re-copies everything from api/admission/ in whatever Calico version the release pins. When release-v1.43 was cut, it pinned the Calico v3.32.0 tag, but that tag predates a Calico commit that moved protect-builtin-tiers.yaml into api/admission/ (it still lived at the old api/config/admission/ path back then), so the re-copy found nothing and silently dropped the file. With the manifest gone, the operator rendered zero ValidatingAdmissionPolicies for Calico instead of the expected two — which broke the build, since the operator's tests assert that those two policies get created. This fix restores that one manifest into the operator's import directory, bringing release-v1.43 back in line with what master already ships and re-arming the guardrail that blocks deletion of the built-in tiers.

Release Note

Restore the protect-builtin-tiers ValidatingAdmissionPolicy for Calico, which prevents deletion of the built-in tiers (default, kube-admin, kube-baseline).

🤖 Generated with Claude Code