Clean up after Kubernetes failure
Require a cleanup command after a failed Kubernetes apply.
apiVersion: atmos/v1
kind: Policy
metadata:
name: lifecycle-cleanup-failed-apply
description: "Require a cleanup command after a failed Kubernetes apply."
spec:
policies:
cleanup-failed-apply:
on: operation
action: hooks
rule: input.event == 'after.kubernetes.apply' && input.status == 'failure'
hooks:
- ref: cleanup
event: after.kubernetes.apply
required: true
require_success: true
hooks:
cleanup:
kind: command
command: /opt/platform/bin/cleanup-component
tools: {}
1 Configure
Set spec.hooks.cleanup.command to your cleanup executable.
Replace /opt/platform/bin/cleanup-component before use. Cleanup does not turn the failed apply into success. Protect the executable and any credentials it uses.
The selected hook must execute and succeed: both required and require_success are true. Dry-run previews it without execution.
2 Save
Save the CEL policy as policy.d/lifecycle-cleanup-failed-apply.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
Replace <component> and <stack> with your target.
atmos kubernetes apply <component> -s <stack>
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
