From 587201317b69007cb01b38d735a1b3b9e0161d85 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sun, 16 Aug 2026 00:09:15 -0500 Subject: [PATCH] PM integration: wire platform/kyverno into the platform render Add platform/kyverno/kustomization.yaml (renders the admission enforcing bundle) and enable the kyverno component in platform/kustomization.yaml (first, so admission policies precede other components). kustomize build verified. Co-Authored-By: Claude Opus 4.8 (1M context) --- platform/kustomization.yaml | 2 +- platform/kyverno/kustomization.yaml | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) create mode 100644 platform/kyverno/kustomization.yaml diff --git a/platform/kustomization.yaml b/platform/kustomization.yaml index 1a1e80e..98f794c 100644 --- a/platform/kustomization.yaml +++ b/platform/kustomization.yaml @@ -11,7 +11,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - # - kyverno # TODO(PM): enable when the policy engineer's kyverno stub lands (WS-TEST) + - kyverno # PM: enabled — admission enforcer first so policies precede other components - cilium - longhorn - cert-manager diff --git a/platform/kyverno/kustomization.yaml b/platform/kyverno/kustomization.yaml new file mode 100644 index 0000000..232de99 --- /dev/null +++ b/platform/kyverno/kustomization.yaml @@ -0,0 +1,10 @@ +# PM integration glue (Phase 0): makes platform/kyverno a Flux platform component. +# Renders the in-cluster ENFORCING bundle authored by WS-TEST (admission/) — Kyverno install +# + the policies shared verbatim with the CI L0 gate (ADR-0011, docs/07 admission enforcement). +# +# The CI-only artifacts (tests/, servicedefinition/ payloads, scripts/run-l0.sh) are intentionally +# NOT rendered into the cluster — they run in CI (.gitea/ + ci/), not in-cluster. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - admission