Change Windows

Restrict replica changes with CEL

Freeze Deployment replica changes in production namespaces during Sunday maintenance, while allowing other Deployment updates. The same condition works for parent Deployment updates and the scale subresource because both payloads contain spec.replicas.

Complete example

apiVersion: addons.projectcapsule.dev/v1alpha1
kind: ChangeWindow
metadata:
  name: replica-maintenance
spec:
  namespaceSelectors:
    - matchLabels:
        environment: production
  schedules:
    - name: weekly
      cron: "0 2 * * 0"
      timeZone: UTC
      duration: 2h
  targets:
    - name: deployments
      apiVersion: apps/v1
      kind: Deployment
  admission:
    - name: freeze-replicas
      targets: [deployments]
      operations: [UPDATE]
      subresources: ["", scale]
      when: Active
      action: Deny
      audience:
        include:
          - kind: Group
            name: application-developers
          - kind: ServiceAccount
            name: deployer
            namespace: production
        exclude:
          - kind: User
            name: break-glass
      matchConditions:
        - name: replicas-changed
          expression: "object.spec.replicas != oldObject.spec.replicas"
      message: "Replica changes are frozen during maintenance."
  config:
    admission:
      warnings:
        - name: upcoming-replica-freeze
          targets: [deployments]
          operations: [UPDATE]
          subresources: ["", scale]
          when: BeforeStart
          within: 1h
          audience:
            include:
              - kind: Group
                name: application-developers
          matchConditions:
            - name: replicas-changed
              expression: "object.spec.replicas != oldObject.spec.replicas"
          message: "Replica changes will be frozen at {{ .window.start }}."

Download conditional-maintenance.yaml

Expected behavior

During the active window, members of application-developers and the production/deployer ServiceAccount cannot change replica counts in namespaces labeled environment: production. A Deployment image update that preserves replicas remains allowed by this rule. The excluded break-glass user is unaffected by the denial. Other namespaces retain their existing behavior.

The warning entry independently selects the developers group and returns a notice on replica updates in the hour before the next window. The ServiceAccount is not included in that warning unless it also belongs to the selected group.

This example matches UPDATE only, so both objects are present. Conditions for CREATE or DELETE must account for null oldObject or object respectively. For subresource writes, CEL receives the actual Scale objects; target label selection uses the parent Deployment. See the matching reference for variables, limits, and error behavior.

Prev
Installation
Next
Freeze deployment changes