Protect production Helm releases
Deny direct deletion of Helm releases in production stacks.
Production Helm releases cannot be deleted directly
apiVersion: atmos/v1
kind: Policy
metadata:
name: lifecycle-deny-production-delete
description: "Deny direct deletion of Helm releases in production stacks."
spec:
policies:
deny-production-delete:
on: operation
action: deny
reason: Production Helm releases cannot be deleted directly
rule: input.event == 'before.helm.delete' && input.stack.startsWith('prod-')
1 Configure
None. Adjust the prod- prefix in the rule to your stack naming convention.
Other Helm operations and non-production stacks do not match. This is an operation rule, not a rendered Kubernetes resource check.
2 Save
Save the CEL policy as policy.d/lifecycle-deny-production-delete.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
Replace <component> and <stack> with your target.
atmos helm delete <component> -s <stack>
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
