All nine cluster policies use the deprecated spec.validationFailureAction

[devantler]

🤖 Generated by the Agentic Engineer

Evidence

Raised by CodeRabbit on platform#2718. Kyverno has deprecated the top-level spec.validationFailureAction (and spec.validationFailureActionOverrides) in favour of the per-rule spec.rules[].validate.failureAction.

All 9 ClusterPolicies under k8s/bases/infrastructure/cluster-policies/best-practices/ use the deprecated top-level form, including restrict-tenant-issuer-refs.yaml, which merged to main recently. Zero use the current form.

Problem and audience

Nothing is broken today — the field still works on the pinned engine (1.18.2 in both ci.yaml's action-install-cli and the kyverno HelmRelease). The exposure is a future Kyverno bump: if the field is removed rather than merely warned on, every policy in the repo stops enforcing at once, and the failure mode is the one this repo has already been bitten by — an Enforce policy that silently protects nothing rather than a loud error.

Deliberately not fixed in platform#2718: converting one policy of nine would leave the directory inconsistent for no safety gain, and the migration wants to move together with a version bump.

Expected behaviour

All nine policies use the current per-rule validate.failureAction, migrated in one change alongside (or ahead of) the next Kyverno bump.

Acceptance criteria

• All nine policies converted; no spec.validationFailureAction remains under cluster-policies/.
• The existing kyverno test ./tests fixtures still pass, with every asserted row reporting REASON=Ok (see kyverno test cannot fail for a policy that matches nothing — Excluded rows satisfy any expectation #3145 — the suite currently cannot fail for a policy that matches nothing, so the row reasons are the real check here).
• The Kubescape compliance gate score is unchanged.
• Bump ci.yaml's pinned CLI and the HelmRelease together, per the comment in ci.yaml.

Size

Small but wide — nine mechanical edits plus one verification pass.

[coderabbitai]

🔗 Related PRs

#2985 - fix(k8s): gate deploy health on a serving CNPG cluster instead of a fully-ready one [merged]
#3037 - fix(cilium): refuse a zero-count gate release and correct the runbook order [merged]
#3085 - security(kubescape): except the operator-bundle RBAC the CI scan actually sees [merged]
#3109 - fix(deploy): avoid redundant GHCR node reboots [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!