Title here
Summary here
Freeze deployment changes
Block Deployment writes during a weekly maintenance window and warn users in advance. This policy is admission-only: it does not modify workloads or need an executor ServiceAccount.
Complete example
apiVersion: addons.projectcapsule.dev/v1alpha1
kind: ChangeWindow
metadata:
name: weekly-maintenance
spec:
namespaceSelectors:
- matchLabels:
maintenance: enabled
schedules:
- name: sunday
cron: "0 2 * * 0"
timeZone: UTC
duration: 2h
targets:
- name: deployments
apiVersion: apps/v1
kind: Deployment
admission:
- name: freeze
targets: [deployments]
operations: [CREATE, UPDATE, DELETE]
subresources: ["", scale]
when: Active
action: Deny
message: "Maintenance is active. Retry after {{ .window.end }}."
config:
admission:
warnings:
- name: upcoming
targets: [deployments]
operations: [CREATE, UPDATE, DELETE]
subresources: ["", scale]
when: BeforeStart
within: 1h
message: "Maintenance begins at {{ .window.start }} (in {{ .window.startsIn }})."Download maintenance-only.yaml
Namespace selectors choose the affected namespaces. Both parent writes and
scale requests are covered. Omitting audience and matchConditions applies
the entry to every caller and matching write during its configured period.
A custom denial message tells users why their request was rejected.
For a narrower freeze, see the replica-change example.