fix: Add default failure policy for K8sNativeValidation templates by Copilot · Pull Request #4568 · open-policy-agent/gatekeeper

Copilot · 2026-05-16T00:16:30Z

ConstraintTemplates that omit failurePolicy need a configurable default applied consistently to Gatekeeper CEL evaluation and generated VAP resources. The default remains fail-closed for backward compatibility.

Runtime flag
- Added --default-k8s-native-validation-failure-policy, defaulting to Fail.
- Accepts Fail or Ignore.
- Validates the configured value at startup.
Failure policy defaulting
- Applies the flag when K8sNativeValidation source.failurePolicy is omitted.
- Preserves explicit per-template failurePolicy values.
- Uses the same default for generated ValidatingAdmissionPolicy specs.
Coverage and docs
- Added unit coverage for schema defaulting, startup validation, and generated VAP failure policy.
- Documented the new flag in current runtime flags and VAP docs.
- Clarified that this flag is separate from validatingWebhookFailurePolicy.

Example:

source:
  validations:
    - expression: "true"
      message: "allowed"
  # failurePolicy omitted; Gatekeeper uses --default-k8s-native-validation-failure-policy

Agent-Logs-Url: https://github.com/open-policy-agent/gatekeeper/sessions/d4a5e66c-314f-4cec-9b97-cec82e05f12f Co-authored-by: JaydipGabani <20255485+JaydipGabani@users.noreply.github.com>

JaydipGabani

@copilot address these changes at all relavent code changes

JaydipGabani · 2026-05-16T02:03:58Z

 The K8s Validating Admission Controller requires both the Validating Admission Policy (VAP) and Validating Admission Policy Binding (VAPB) resources to exist to enforce a policy. Gatekeeper can be configured to generate both of these resources. To generate VAP Bindings for all Constraints, ensure the Gatekeeper 
 `--default-create-vap-binding-for-constraints` flag is set to `true`. To generate VAP as part of all Constraint Templates with the VAP CEL engine `K8sNativeValidation`, ensure the Gatekeeper `--default-create-vap-for-templates=true` flag is set to `true`. By default both flags are set to `true` now that the feature is in beta.

+If a K8sNativeValidation source omits `failurePolicy`, Gatekeeper uses `--default-failure-policy`, which defaults to `Fail`, for both Gatekeeper's CEL evaluation and generated VAP resources.


This should not be added to versioned documents since this is a new change

Removed the new documentation from versioned docs in 25a18c4.

JaydipGabani · 2026-05-16T02:12:17Z

 	"k8s.io/apiserver/pkg/admission/plugin/webhook/matchconditions"
 )

+var DefaultFailurePolicy = flag.String("default-failure-policy", string(admissionv1.Fail), "(beta) Failure policy to use when a K8sNativeValidation source omits failurePolicy. Allowed values are Fail or Ignore.")


lets rename this flag here and everywhere else

Suggested change

var DefaultFailurePolicy = flag.String("default-failure-policy", string(admissionv1.Fail), "(beta) Failure policy to use when a K8sNativeValidation source omits failurePolicy. Allowed values are Fail or Ignore.")

var DefaultFailurePolicy = flag.String("default-failure-policy-for-cel-engine", string(admissionv1.Fail), "(beta) Failure policy to use when a K8sNativeValidation source omits failurePolicy. Allowed values are Fail or Ignore.")

Renamed the flag to --default-failure-policy-for-cel-engine in code and current docs in 25a18c4.

Agent-Logs-Url: https://github.com/open-policy-agent/gatekeeper/sessions/35837324-09cf-4f4d-8b5c-095e242264bd Co-authored-by: JaydipGabani <20255485+JaydipGabani@users.noreply.github.com>

JaydipGabani

@copilot

Rename the flag to something explicit--default-k8s-native-validation-failure-policy.

Validate the flag at startup, not lazily when a template is parsed.

Update docs to explicitly contrast this with validatingWebhookFailurePolicy.

JaydipGabani · 2026-05-16T02:23:29Z

 	"k8s.io/apiserver/pkg/admission/plugin/webhook/matchconditions"
 )

+var DefaultFailurePolicy = flag.String("default-failure-policy-for-cel-engine", string(admissionv1.Fail), "(beta) Failure policy to use when a K8sNativeValidation source omits failurePolicy. Allowed values are Fail or Ignore.")


lets rename this flag and variable here and everywhere else

Suggested change

var DefaultFailurePolicy = flag.String("default-failure-policy-for-cel-engine", string(admissionv1.Fail), "(beta) Failure policy to use when a K8sNativeValidation source omits failurePolicy. Allowed values are Fail or Ignore.")

var DefaultFailurePolicyForK8sNativeValidation = flag.String("default-k8s-native-validation-failure-policy", string(admissionv1.Fail), "(beta) Failure policy to use when a K8sNativeValidation source omits failurePolicy. Allowed values are Fail or Ignore.")

Renamed the flag and variable to --default-k8s-native-validation-failure-policy / DefaultFailurePolicyForK8sNativeValidation in 373e1c9.

Copilot · 2026-05-16T02:27:10Z

@copilot address these changes at all relavent code changes

Addressed the relevant updates in 25a18c4: renamed the flag everywhere it remains and removed the new entries from versioned docs.

Agent-Logs-Url: https://github.com/open-policy-agent/gatekeeper/sessions/77583064-3ed1-4ba0-b77b-664c7df23201 Co-authored-by: JaydipGabani <20255485+JaydipGabani@users.noreply.github.com>

Copilot · 2026-05-16T02:42:55Z

@copilot

Rename the flag to something explicit--default-k8s-native-validation-failure-policy....

Implemented in 373e1c9: renamed the flag to --default-k8s-native-validation-failure-policy, added startup validation for invalid values, and updated current docs to distinguish it from validatingWebhookFailurePolicy.

Copilot

Pull request overview

Adds a configurable runtime flag --default-k8s-native-validation-failure-policy that supplies a default failurePolicy for K8sNativeValidation sources when omitted, applied consistently to Gatekeeper's CEL evaluation and generated VAP resources. Default remains Fail for backward compatibility.

Changes:

Introduce the new flag and a ValidateDefaultFailurePolicyForK8sNativeValidation startup check in main.go; Source.GetFailurePolicy/GetV1Beta1FailurePolicy now fall back to the flag when FailurePolicy is nil, while Source.Validate only validates explicit values.
Add unit tests covering default behavior, startup validation, and VAP generation using the default.
Document the new flag in runtime flags and the VAP docs, clarifying it is distinct from validatingWebhookFailurePolicy.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/drivers/k8scel/schema/schema.go	Adds flag, refactors failure policy resolution/validation.
pkg/drivers/k8scel/schema/schema_test.go	Adds tests for default policy resolution and startup validation.
pkg/drivers/k8scel/transform/make_vap_objects_test.go	Verifies generated VAP uses default failure policy.
main.go	Validates flag value at startup, fails fast on invalid input.
website/docs/runtime-flags.md	Documents the new flag.
website/docs/validating-admission-policy.md	Clarifies default behavior and distinction from webhook failure policy.

Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>

Initial plan

0def22a

Copilot AI assigned Copilot and JaydipGabani May 16, 2026

Copilot AI requested review from Copilot and removed request for Copilot May 16, 2026 00:16

Copilot started work on behalf of JaydipGabani May 16, 2026 00:16 View session

Copilot AI linked an issue May 16, 2026 that may be closed by this pull request

Add 'default-failure-policy` flag to control failure policy on constraint template if the field is missing #4567

Open

Add default failure policy flag

a170a2a

Agent-Logs-Url: https://github.com/open-policy-agent/gatekeeper/sessions/d4a5e66c-314f-4cec-9b97-cec82e05f12f Co-authored-by: JaydipGabani <20255485+JaydipGabani@users.noreply.github.com>

Copilot AI requested review from Copilot and removed request for Copilot May 16, 2026 00:22

Copilot AI changed the title ~~[WIP] Add 'default-failure-policy' flag for constraint template~~ Add default failure policy for K8sNativeValidation templates May 16, 2026

Copilot finished work on behalf of JaydipGabani May 16, 2026 00:34

Copilot AI requested a review from JaydipGabani May 16, 2026 00:34

JaydipGabani requested changes May 16, 2026

View reviewed changes

Copilot started work on behalf of JaydipGabani May 16, 2026 02:16 View session

Address default failure policy review feedback

25a18c4

Agent-Logs-Url: https://github.com/open-policy-agent/gatekeeper/sessions/35837324-09cf-4f4d-8b5c-095e242264bd Co-authored-by: JaydipGabani <20255485+JaydipGabani@users.noreply.github.com>

Copilot AI requested review from Copilot and removed request for Copilot May 16, 2026 02:19

JaydipGabani requested changes May 16, 2026

View reviewed changes

Copilot finished work on behalf of JaydipGabani May 16, 2026 02:27

Copilot AI requested a review from JaydipGabani May 16, 2026 02:27

Copilot started work on behalf of JaydipGabani May 16, 2026 02:27 View session

Validate K8sNativeValidation failure policy flag at startup

373e1c9

Agent-Logs-Url: https://github.com/open-policy-agent/gatekeeper/sessions/77583064-3ed1-4ba0-b77b-664c7df23201 Co-authored-by: JaydipGabani <20255485+JaydipGabani@users.noreply.github.com>

Copilot AI requested review from Copilot and removed request for Copilot May 16, 2026 02:39

Copilot finished work on behalf of JaydipGabani May 16, 2026 02:43

JaydipGabani marked this pull request as ready for review May 16, 2026 03:14

JaydipGabani requested a review from a team as a code owner May 16, 2026 03:14

Copilot AI review requested due to automatic review settings May 16, 2026 03:14

Copilot started reviewing on behalf of JaydipGabani May 16, 2026 03:14 View session

Copilot AI reviewed May 16, 2026

View reviewed changes

JaydipGabani changed the title ~~Add default failure policy for K8sNativeValidation templates~~ fix: Add default failure policy for K8sNativeValidation templates May 18, 2026

charleswool mentioned this pull request May 18, 2026

Control plane deadlock via Gatekeeper-Generated ValidatingAdmissionPolicies #4530

Open

JaydipGabani added 2 commits May 18, 2026 23:46

add default-k8s-native-validation-failure-policy in gator

15ac3f7

Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>

remote default-k8s-native-validation-failure-policy from gator bench

0cbdd74

Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>

JaydipGabani mentioned this pull request May 19, 2026

feat: add default-failure-policy flag to fix #4567 #4581

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: Add default failure policy for K8sNativeValidation templates#4568

fix: Add default failure policy for K8sNativeValidation templates#4568
JaydipGabani with Copilot wants to merge 6 commits into
masterfrom
copilot/add-default-failure-policy-flag

Copilot AI commented May 16, 2026 •

edited

Loading

Uh oh!

JaydipGabani left a comment

Uh oh!

JaydipGabani May 16, 2026

Uh oh!

Copilot AI May 16, 2026

Uh oh!

JaydipGabani May 16, 2026

Uh oh!

Copilot AI May 16, 2026

Uh oh!

JaydipGabani left a comment

Uh oh!

JaydipGabani May 16, 2026

Uh oh!

Copilot AI May 16, 2026

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	var DefaultFailurePolicy = flag.String("default-failure-policy", string(admissionv1.Fail), "(beta) Failure policy to use when a K8sNativeValidation source omits failurePolicy. Allowed values are Fail or Ignore.")
	var DefaultFailurePolicy = flag.String("default-failure-policy-for-cel-engine", string(admissionv1.Fail), "(beta) Failure policy to use when a K8sNativeValidation source omits failurePolicy. Allowed values are Fail or Ignore.")

	var DefaultFailurePolicy = flag.String("default-failure-policy-for-cel-engine", string(admissionv1.Fail), "(beta) Failure policy to use when a K8sNativeValidation source omits failurePolicy. Allowed values are Fail or Ignore.")
	var DefaultFailurePolicyForK8sNativeValidation = flag.String("default-k8s-native-validation-failure-policy", string(admissionv1.Fail), "(beta) Failure policy to use when a K8sNativeValidation source omits failurePolicy. Allowed values are Fail or Ignore.")

Uh oh!

Conversation

Copilot AI commented May 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JaydipGabani left a comment

Choose a reason for hiding this comment

Uh oh!

JaydipGabani May 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 16, 2026

Choose a reason for hiding this comment

Uh oh!

JaydipGabani May 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 16, 2026

Choose a reason for hiding this comment

Uh oh!

JaydipGabani left a comment

Choose a reason for hiding this comment

Uh oh!

JaydipGabani May 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 16, 2026 •

edited

Loading