The Homepage group policy blocks deleting a route, so a retirement cannot remove it #4732

🤖 Generated by the Agentic Engineer

Evidence

Merge-queue run 38113692499 for #4639 (retire Backstage) failed its production deploy on 2026-10-11 and was removed from the queue. The Flux event on the apps layer at 05:23:20Z reads:

PruneFailed  HTTPRoute/backstage/backstage delete failed: admission webhook "validate.kyverno.svc-fail" denied the request:
resource HTTPRoute/backstage/backstage was blocked due to the following policies
restrict-homepage-service-groups: declared-service-group: 'A route with gethomepage.dev/enabled="true" must set gethomepage.dev/group to a service group declared in the Homepage layout ...'

#4639 removes the Internal Developer Platform group from the policy's list and the only route that uses it. The infrastructure layer applied the shorter list first (05:23:15Z). Five seconds later the apps layer tried to delete the route, and the policy judged the route being deleted against the new list and refused.

The route therefore stayed, its access grant was already gone, the gateway rejected it (ResolvedRefs/RefNotPermitted), and the deploy's route check failed after 300 s. Backstage was unreachable for about 25 minutes until the next queue entry restored main.

Cause

The declared-service-group rule matches every operation on HTTPRoute and Ingress. On a delete it evaluates the object being removed, so a route whose group is no longer declared can never be deleted, by Flux or by hand.

Who is affected

Anyone retiring or renaming a Homepage group together with its last route, and anyone trying to delete a route that already violates the policy. The second case is the worse one: the policy stops the cleanup of exactly the routes it objects to.

Expected behaviour

The policy judges routes that are created or changed. Deleting a route is always allowed.

Acceptance criteria

• The rule applies to create and update only.
• A test shows a delete of a route with an undeclared group is admitted, and a create of the same route is still refused.
• After this ships, fix(platform): retire the unused Backstage portal #4639 can remove its group and route in one deploy.

Also seen, not part of this issue

Flux reported PruneFailed and then ReconciliationSucceeded five minutes later, and the deploy's reconcile step passed. Only the later route check noticed. Whether the deploy should fail on a prune failure is a separate question.

Size: S.