• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

kubevirt / hyperconverged-cluster-operator / 20751599122
82%
main: 76%

Build:
Build:
LAST BUILD BRANCH: bump_MIGRATION_OPERATOR_v0.0.14_main
DEFAULT BRANCH: main
Ran 06 Jan 2026 02:42PM UTC
Jobs 1
Files 60
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

06 Jan 2026 02:37PM UTC coverage: 82.44% (-0.5%) from 82.989%
20751599122

push

github

web-flow
[release 1.13] Add ValidatingAdmissionPolicy to validate the HyperConverged namespace (#3950)

* Add the new admission policy controller

The current implementation of preventing the creation of the
HyperConverged CR in non-allowed namespace, is not working in Openshift,
where becasue of a race condition, the webhook's namespace selector is
removed by OLM.

This commit adds a new controller, to create and reconcile a
ValidatingAdmissionPolicy and the related
ValidatingAdmissionPolicyBinding, to perform the same validation.

The reason we're doing it in a new controller, is because we need the
ValidatingAdmissionPolicy to be set, even if the HyperConverged CR is
not deployed, while our main controller only reconciles resources if
the HyperConverged CR is deployed.



* Register the admission policy controller on boot



* Remove the current validation

Remove the existing validation of the HyperConverged CR namespace from
the validation webhook, as it is now done by the policy, created by the
admission policy controller.



* Don't remove the namespace selector from the validation wh

OLM adds a namespace selection on the validation webhook CR, causing the
namespace validation to be not relevant.

The webhook setup logic removes this selector, but actually this is
reconciled by OLM, and eventually, user can still create the
HyperConverged CR in any namespace.

The issue is now handled by a ValidationgAdmissionPolicy, and so we
don't need this logic anymore, and so this commit removes it.



---------

Signed-off-by: Nahshon Unna Tsameret <nahsh.ut@gmail.com>

138 of 209 new or added lines in 2 files covered. (66.03%)

3 existing lines in 1 file now uncovered.

5709 of 6925 relevant lines covered (82.44%)

0.92 hits per line

New Missed Lines in Diff

Lines Coverage ∆ File
8
90.7
controllers/admissionpolicy/resources.go
63
48.78
controllers/admissionpolicy/admission_policy_controller.go

Uncovered Existing Lines

Lines Coverage ∆ File
3
90.67
-1.08% pkg/webhooks/validator/validator.go
Jobs
ID Job ID Ran Files Coverage
1 20751599122.1 06 Jan 2026 02:42PM UTC 60
82.44
GitHub Action Run
Source Files on build 20751599122
  • Tree
  • List 60
  • Changed 2
  • Source Changed 0
  • Coverage Changed 2
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • c206538f on github
  • Prev Build on release-1.13 (#19324433500)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc