Fix CEL to actually block deprecated resource create#313
Merged
Conversation
optionalOldSelf/hasValue() require Kubernetes 1.29+. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
jaypipes
approved these changes
May 1, 2026
carlydf
added a commit
that referenced
this pull request
May 1, 2026
<!--- Note to EXTERNAL Contributors -->
<!-- Thanks for opening a PR!
If it is a significant code change, please **make sure there is an open
issue** for this.
We work best with you when we have accepted the idea first before you
code. -->
<!--- For ALL Contributors 👇 -->
## What was changed
Without `optionalOldSelf: true`, oldSelf is either present (on update)
or rule is skipped (on create).
We want the rule to be enforced on create!
Also, oldSelf != nil doesn't work, must be hasValue()
## Why?
To behave as documented and expected after deprecating the old CRDs
## Checklist
<!--- add/delete as needed --->
1. Closes <!-- add issue number here -->
2. How was this tested:
In local cluster I tested that you could update an existing object, but
that you could not create one.
Also tested with the old rule and saw that it did not actually block
creation.
Note: regardless of the CEL rule, all operations (get, delete, describe,
etc) print this warning, which is nice:
```
Warning: TemporalConnection is deprecated. Use Connection instead.
```
3. Any docs updates needed?
<!--- update README if applicable
or point out where to update docs.temporal.io -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was changed
Without
optionalOldSelf: true, oldSelf is either present (on update) or rule is skipped (on create).We want the rule to be enforced on create!
Also, oldSelf != nil doesn't work, must be hasValue()
Why?
To behave as documented and expected after deprecating the old CRDs
Checklist
Closes
How was this tested:
In local cluster I tested that you could update an existing object, but that you could not create one.
Also tested with the old rule and saw that it did not actually block creation.
Note: regardless of the CEL rule, all operations (get, delete, describe, etc) print this warning, which is nice: