admission: validate spec.hibernatePolicy

admission/cocoonset_validator.go

@@ -129,6 +129,9 @@ func validateCocoonSetSpec(cs *cocoonv1.CocoonSet) []string {
 	if cs.Spec.SnapshotPolicy != "" && !cs.Spec.SnapshotPolicy.IsValid() {
 		errs = append(errs, fmt.Sprintf("spec.snapshotPolicy must be always, main-only, or never, got %q", cs.Spec.SnapshotPolicy))
 	}
+	if cs.Spec.HibernatePolicy != "" && !cs.Spec.HibernatePolicy.IsValid() {
+		errs = append(errs, fmt.Sprintf("spec.hibernatePolicy must be retain or release, got %q", cs.Spec.HibernatePolicy))
+	}
 
 	return errs
 }

admission/cocoonset_validator_test.go

@@ -136,6 +136,14 @@ func TestValidateCocoonSetSpec(t *testing.T) {
 			}},
 			wantContains: []string{"snapshotPolicy"},
 		},
+		{
+			name: "rejects bad hibernate policy",
+			cs: &cocoonv1.CocoonSet{Spec: cocoonv1.CocoonSetSpec{
+				Agent:           cocoonv1.AgentSpec{Image: "x"},
+				HibernatePolicy: "relase",
+			}},
+			wantContains: []string{"hibernatePolicy"},
+		},
 		{
 			name: "accepts resource quantity for storage",
 			cs: &cocoonv1.CocoonSet{Spec: cocoonv1.CocoonSetSpec{

docs/validation.md

@@ -21,6 +21,7 @@ validation cannot express:
 - `spec.toolboxes[*]` static-mode entries must declare a valid `connType` (`ssh` / `rdp` / `vnc` / `adb`)
 - clone-mode images (`spec.agent.image`, `spec.toolboxes[*].image`) must be `repo[:tag]` — registry ports and digests are rejected, because the snapshot pull path resolves images under the org registry base and has no external-ref fallback
 - `spec.snapshotPolicy ∈ {always, main-only, never}`
+- `spec.hibernatePolicy ∈ {retain, release}`
 
 These rules run on CocoonSet CREATE and UPDATE, behind the
 `POST /validate-cocoonset` endpoint — see [Overview](overview.md) for

go.mod

@@ -3,7 +3,7 @@ module github.com/cocoonstack/cocoon-webhook
 go 1.26.5
 
 require (
-	github.com/cocoonstack/cocoon-common v0.2.7
+	github.com/cocoonstack/cocoon-common v0.2.8-0.20260724145826-4363e4ff03ee
 	github.com/projecteru2/core v0.0.0-20241016125006-ff909eefe04c
 	github.com/prometheus/client_golang v1.23.2
 	github.com/prometheus/client_model v0.6.2

go.sum

@@ -27,8 +27,8 @@ github.com/cockroachdb/logtags v0.0.0-20230118201751-21c54148d20b h1:r6VH0faHjZe
 github.com/cockroachdb/logtags v0.0.0-20230118201751-21c54148d20b/go.mod h1:Vz9DsVWQQhf3vs21MhPMZpMGSht7O/2vFW2xusFUVOs=
 github.com/cockroachdb/redact v1.1.3 h1:AKZds10rFSIj7qADf0g46UixK8NNLwWTNdCIGS5wfSQ=
 github.com/cockroachdb/redact v1.1.3/go.mod h1:BVNblN9mBWFyMyqK1k3AAiSxhvhfK2oOZZ2lK+dpvRg=
-github.com/cocoonstack/cocoon-common v0.2.7 h1:0c3Sc3aqtaHxpOHuc45jCaeR4XnMcaYbeic9d3jPP+Y=
-github.com/cocoonstack/cocoon-common v0.2.7/go.mod h1:2TySEuBWhZIhxJkHbjcoQghwcDqAJ0y48c+/wag7Cws=
+github.com/cocoonstack/cocoon-common v0.2.8-0.20260724145826-4363e4ff03ee h1:KshBIXkOlQMNdL7DPoYXitxq+qeWyQSqQsvIpDV0gv4=
+github.com/cocoonstack/cocoon-common v0.2.8-0.20260724145826-4363e4ff03ee/go.mod h1:VSfgYiWxoHRnWybzQNaxmK4kVoLT9ffiMKll5/i92CM=
 github.com/codegangsta/inject v0.0.0-20150114235600-33e0aa1cb7c0/go.mod h1:4Zcjuz89kmFXt9morQgcfYZAYZ5n8WHjt81YYWIwtTM=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=

main.go

@@ -80,7 +80,7 @@ func main() {
 		version.VERSION, version.REVISION, version.BUILTAT, listen, metricsListen)
 
 	specs := []commonhttpx.ServerSpec{
-		commonhttpx.HTTPSServerSpec(webhookServer, "", ""),
+		commonhttpx.HTTPSServerSpec(webhookServer),
 		commonhttpx.HTTPServerSpec(metricsServer),
 	}
 	if err := commonhttpx.Run(ctx, shutdownTimeout, specs...); err != nil {