T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/admission/helmrelease.yaml

@@ -0,0 +1,51 @@
+# SCAFFOLDING for a later phase (Phase 2, task T-2.7) -- NOT applied in Phase 0
+# (no cluster exists yet). Installs Kyverno so the SAME L0 policies run in-cluster
+# as an admission controller (defense in depth per docs/07, ADR-0011). Flux
+# HelmRelease skeleton; chart/app versions are pinned and bumped via the update path.
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: kyverno
+  namespace: kyverno
+spec:
+  interval: 24h
+  url: https://kyverno.github.io/kyverno/
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kyverno
+  namespace: kyverno
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: kyverno
+      version: "3.3.x"            # pin to the exact chart the operator vendors
+      sourceRef:
+        kind: HelmRepository
+        name: kyverno
+        namespace: kyverno
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    # HA admission controller so a single pod restart cannot open an enforcement gap.
+    admissionController:
+      replicas: 3
+    backgroundController:
+      enabled: true               # needed for generate (default-deny baseline) + sync
+    reportsController:
+      enabled: true
+    cleanupController:
+      enabled: true
+    # Fail-CLOSED: if the webhook is unreachable, reject rather than silently admit
+    # non-conforming resources (coordination-protocol.md #8). Tune per-resource in
+    # the policies' webhook config if a bootstrap deadlock appears.
+    config:
+      webhooks:
+        - failurePolicy: Fail