EPMDEDP-17271: feat: validate Codebase deletion against deployment usage and return structured errors - #312
Merged
Conversation
SergK
force-pushed
the
fix/EPMDEDP-17271-validate-codebase-deletion
branch
2 times, most recently
from
August 8, 2026 12:31
89a784b to
221da00
Compare
Collaborator
Pipeline
|
| Status | Task | Duration |
|---|---|---|
| ✅ | github-set-pending-status | 47s |
| ✅ | fetch-repository | 20s |
| ✅ | init-values | 7s |
| ✅ | get-cache | 2m11s |
| ✅ | commit-validate | 7s |
| ✅ | dockerfile-lint | 8s |
| ✅ | helm-lint | 21s |
| ✅ | helm-docs | 24s |
| ✅ | build | 45s |
| ✅ | sonar | 49s |
| ✅ | save-cache | 6s |
| ✅ | buildkit-build | 32s |
| ✅ | github-report-pipeline-status | 16s |
…age and return structured errors A Codebase referenced by a CDPipeline or by a Stage quality gate could be deleted, leaving the deployment pointing at a component that no longer exists. Only admission can prevent that, since any client can issue the delete. CodebaseValidationWebhook.ValidateDelete now rejects the request when a CDPipeline lists the codebase in spec.applications or spec.applicationsToPromote, lists one of its branches in spec.inputDockerStreams, or a Stage quality gate names it as autotestName. The branch case matters because deleting a Codebase cascades to its branches and the CodebaseBranch webhook lets that cascade through, so the branches' own protection does not apply. The Codebase and CodebaseBranch checks both report every blocking reference and deny with an *apierrors.StatusError carrying Reason=Forbidden, Code=403 and one metav1.StatusCause per reference, so clients read the referencing resource from Details.Causes rather than parsing the message. Listing, terminating-resource filtering and CRD-availability handling are shared through pkg/deploymentusage. Neither lookup scans the namespace per branch. The Codebase check selects branches on a spec.codebaseName field index registered on the manager cache; a missing index fails the List instead of silently falling back to a full scan, so RegisterFieldIndexes runs unconditionally before the cache starts and the webhook denies rather than under-reporting usage. The stale branch sweep resolves the retaining resource from a single BranchUsageIndex built per sweep, instead of re-reading the CDPipelines and Stages for every stale branch; only the auto cleanup strategy consumes it, so branches that are merely marked keep emitting the events they did before. Measured with 50 codebases of 10 branches, 10 CDPipelines and 20 Stages, a Codebase delete admission dropped from 1265us to 570us. Signed-off-by: Sergiy Kulanov <sergiy_kulanov@epam.com>
SergK
force-pushed
the
fix/EPMDEDP-17271-validate-codebase-deletion
branch
from
August 8, 2026 13:54
221da00 to
cbd7900
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A Codebase referenced by a CDPipeline or by a Stage quality gate could be deleted, leaving the deployment pointing at a component that no longer exists. Only admission can prevent that, since any client can issue the delete.
CodebaseValidationWebhook.ValidateDelete now rejects the request when a CDPipeline lists the codebase in spec.applications or spec.applicationsToPromote, lists one of its branches in spec.inputDockerStreams, or a Stage quality gate names it as autotestName. The branch case matters because deleting a Codebase cascades to its branches and the CodebaseBranch webhook lets that cascade through, so the branches' own protection does not apply.
The Codebase and CodebaseBranch checks both report every blocking reference and deny with an *apierrors.StatusError carrying Reason=Forbidden, Code=403 and one metav1.StatusCause per reference, so clients read the referencing resource from Details.Causes rather than parsing the message.
Listing, terminating-resource filtering and CRD-availability handling are shared through pkg/deploymentusage.