Skip to main content

Enforcement Modes

Enforcement modes control whether deployments can override a policy's availability class using annotations.

Modes​

ModeBehavior
strictPolicy cannot be overridden by annotations
flexibleAnnotations can increase but never decrease availability below minimumClass
advisoryAnnotations can freely override the policy (default)

Strict​

No overrides allowed. The policy's availability class is always applied regardless of deployment annotations.

spec:
  availabilityClass: high-availability
  enforcement: strict

Flexible​

Annotations can upgrade the availability class but cannot downgrade below the policy's minimumClass.

spec:
  availabilityClass: standard
  enforcement: flexible
  minimumClass: standard  # Cannot go below standard

A deployment annotated with pdboperator.io/availability-class: mission-critical would be accepted (upgrade), but non-critical would be rejected (downgrade below minimum).

Advisory​

Annotations can freely override the policy. This is the default mode.

spec:
  availabilityClass: standard
  enforcement: advisory

Use advisory mode when teams should be able to set their own availability requirements.

Resolution Logic​

The operator resolves the effective configuration based on the combination of policy and annotations:

ScenarioResult
No policy, annotation presentUse annotation
No policy, no annotationSkip (no PDB created)
Policy with strictUse policy (annotations ignored)
Policy with flexible, annotation >= minimumClassUse annotation
Policy with flexible, annotation < minimumClassUse minimumClass
Policy with advisory, annotation presentUse annotation (if allowOverride: true)
Policy with advisory, no annotationUse policy