[github-actions]

What this PR does

My new Instance's pods aren't being created and the InferenceReplica shows the operation waiting on AdmissionUnavailable with an InstanceAdmissionUnavailable warning naming a third-party webhook — is the attempt failing, and does the readiness deadline still run?

Why we need it

Source change: ome-projects/ome@2dfc9e5

Processes the prior plan's pending omenative-lifecycle concern of the same slug; re-verified today, and no PR covers it (instances.md is now free: #207-#211 merged). From commit 11 (#1201), whose patch adds EventReasonInstanceAdmissionUnavailable (emission at patch hunk line +27484, once-per-episode tests at +27222-27372, read today). Current code verified today: pkg/controller/v1beta1/workload/types/events.go:78-84 — the Warning fires once per episode when the apiserver refuses an Instance's pod create or patch because it cannot reach an admission webhook; the attempt is NOT failed: it waits with its InstanceReadyTimeout clock parked until admission answers again, and the event carries the apiserver's own words so the operator can see which webhook is unreachable; types/evidence classification in workload/evidence/rejection.go:78 records RejectionReasonAdmissionUnavailable; the hold lives in workload/holds/admission.go (waiting token, LastFailure under the same reason, release — holds/admission_test.go:45-133), and emission is at ops/create_rejection.go:210. Tests in today's checkout: ops/create_external_test.go:4466-4488 and :4598-4638 (once per episode, create and added index), ops/update_inplace_test.go:1188-1208, workload/pass_update_test.go:1277-1286 (Operation.Waiting = AdmissionUnavailable, never a failure). Docs gaps verified today: concepts/omenative/instances.md's waiting table (:133-140) lists QuotaExceeded, Unschedulable, PodGroupTerminating, NodeUnknown, Paused and SourceUnrouted — no AdmissionUnavailable row — and guides/omenative/set-instance-readiness-deadlines.md:31's clock-stop list ('a scheduling gate, a quota refusal, an unschedulable pod, an unreachable node or a paused rollout') omits the admission wait; a repo-wide grep shows InstanceAdmissionUnavailable nowhere under src/lib/content (only reference/kubectl-ome/instance.md:204 names the AdmissionUnavailable waiting token, merged #111, which needs no change). One independent concern: one hold token and its one Warning event from the commit that added them, as a row in the table that owns operation holds plus the clock-stop list that enumerates them. instances.md and set-instance-readiness-deadlines.md are shared with other items in this plan — the workflow selects one per file and queues the rest; do not combine.

Scope: omenative-lifecycle / admission-unavailable-operation-hold. Other concerns are deferred.

How to test

• Passed the documentation path and size guard (under 1000 added plus deleted lines; no file-count limit).
• Passed an independent accuracy and single-concern review.
• Passed git diff --check and website content/link tests, type checks, lint and production build.

Checklist

• Every commit is signed off (git commit -s)
• pnpm lint && pnpm check && pnpm test && pnpm build passes (run by the publisher on an isolated copy)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 541678a6-e9ec-4763-a2a8-3b9e9eefb087

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[github-actions]

Documentation maintenance: ready. Unsuccessful content rounds: 0/3. Operational attempts: 0/3.

Head: de7f34a7c646fcc9e030b68ed50e687e5ac22ddb; reviewed main: 2d7041091d7a485b4b8c51ff3d6b2d09b17aa3f1.

The diff documents one concern — the AdmissionUnavailable operation hold and its InstanceAdmissionUnavailable warning — as a row in the waiting table that owns holds, one explanatory paragraph, and the matching entry in the deadlines guide's clock-stop list. Every claim matches executable behavior at the pinned commit: the token value and classification (apirejection.go:81, evidence/rejection.go:32-80) fire on both pod create (ops/create.go:1447) and in-place patch (ops/update_inplace.go:493) writes; the attempt keeps its phase and operation with no RetryBlock charged (create_external_test.go:4444+ asserts Creating, operation intact, zero retry-block writes); lastFailure is recorded under the same reason with the refused pod and the apiserver's message naming the webhook (holds/admission.go:64-77, admission_test.go:45-54); the warning fires once per episode (pass_update_test.go:1277: one event over six refused passes); release happens when a write passes admission (create.go:1472, update_inplace.go:352); and the hold parks the InstanceReadyTimeout clock via OperationExternallyHeld (scheduling.go:44, escalation/deadline.go:116). No since badges or release claims added, no protected files touched, checks.json is empty.

Workflow evidence

Human review threads and CODEOWNER approval remain under repository policy.