[devantler]

🤖 Generated by the Agentic Engineer

Why

The policy system has not checked the cluster's own system areas since June (#4228). Before the proposed repair can stop filtering those areas out, the rule that sizes workloads automatically has to leave those areas alone, because prod already sizes their controllers with hand-written settings of the same names. If that rule reached them, it and the deployment tooling would keep overwriting each other.

What

The automatic sizing rule now skips the four system areas explicitly, so it no longer depends on the global filter to stay out. Nothing changes today, because the filter still hides those areas. This clears the prerequisite that the #4228 decision named before the filter entries can be removed.

Fixes #4231

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[devantler]

🤖 Generated by the Agentic Engineer

Evaluation at c01d7959. Nothing is live to try, because Kyverno's resource filters still hide these namespaces. So the evidence is the policy's own behaviour under kyverno apply against probe workloads (a Deployment in kube-system, kyverno and default, and a DaemonSet in kube-system):

policy	VPAs generated
main (d05d6b07)	4: kube-system/probe, kyverno/probe, kube-system/probe-ds, default/probe
this PR	1: default/probe

ksail workload validate passes for both overlays (671 files each). Prod's static VPAs in the hetzner overlay (15 in kube-system, 4 in kyverno) are unchanged and keep sizing those controllers.

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 01da39fb-42b9-45cc-b1f3-47e6b904d2cc

📥 Commits

Reviewing files that changed from the base of the PR and between d05d6b0 and c01d795.

📒 Files selected for processing (1)

• k8s/bases/infrastructure/cluster-policies/best-practices/auto-vpa.yaml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (10)

• GitHub Check: zizmor
• GitHub Check: 🔍 Detect Changes
• GitHub Check: 🔏 Validate Cosign Matcher Efficacy
• GitHub Check: Analyze (javascript-typescript)
• GitHub Check: Analyze (go)
• GitHub Check: Analyze (python)
• GitHub Check: Analyze (actions)
• GitHub Check: Analyze (javascript-typescript)
• GitHub Check: Analyze (python)
• GitHub Check: Analyze (go)

🔇 Additional comments (1)

k8s/bases/infrastructure/cluster-policies/best-practices/auto-vpa.yaml (1)

3-10: LGTM!

Also applies to: 46-48, 59-66, 135-142, 217-224

---

📝 Walkthrough

Walkthrough

The auto-VPA policy now excludes kube-system, kube-public, kube-node-lease, and kyverno from VPA generation for Deployments, StatefulSets, and DaemonSets. Its header and description document the exclusions and note that prod uses static VPAs in those namespaces.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to c01d7

The change is reported to apply the requested namespace exclusions across all three VPA rules, with no actionable merge risk identified.

Architecture Summary

Architecture risk: 🔵 Low · up to c01d7

The change affects 1 system.

Changed systems: k8s

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — k8s (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in k8s/bases/infrastructure/cluster-policies/best-practices/auto-vpa.yaml: The header now states that every rule excludes the four system namespaces and that the exclusions prevent generated VPAs from conflicting with same-named static VPAs if Kyverno’s global resource filters stop excluding those namespaces. It replaces the previous note that the policy’s match rules did not exclude kube-system.
• observed — Modified behavior in k8s/bases/infrastructure/cluster-policies/best-practices/auto-vpa.yaml: The policy description replaces its claim that VPAs are generated in every namespace, including kube-system, with a statement that generation excludes kube-system, kube-public, kube-node-lease, and kyverno, where prod uses static VPAs.
• observed — Modified behavior in k8s/bases/infrastructure/cluster-policies/best-practices/auto-vpa.yaml: The Deployment rule now excludes kube-system, kube-public, kube-node-lease, and kyverno from VPA generation.
• observed — Modified behavior in k8s/bases/infrastructure/cluster-policies/best-practices/auto-vpa.yaml: The StatefulSet rule now excludes kube-system, kube-public, kube-node-lease, and kyverno from VPA generation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	PR #4232 satisfies the coding requirements in directly linked issue #4231. The head file adds an explicit exclusion for kube-system, kube-public, kube-node-lease, and kyverno to the Deployment…
Out of Scope Changes check	✅ Passed	The reviewed change is limited to auto-vpa.yaml. The added policy comments, description update, and three namespace exclusion blocks document and implement issue #4231. No unrelated change is shown.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Title check	✅ Passed	The title clearly and concisely describes the main change: adding explicit exclusions for system namespaces in the automatic VPA policy.
Description check	✅ Passed	The description directly explains why the exclusions are needed, what changes, the current runtime impact, and the linked issue.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}