T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/policies/validate-default-deny-shape.yaml

@@ -0,0 +1,43 @@
+# Serves: R-NET-01 (baseline must actually deny both directions)
+# Spec: docs/03 "Deny all ingress and deny all egress by default".
+#
+# Catches a MALFORMED baseline: a NetworkPolicy claiming to be the default-deny
+# baseline (label homelab.keithjackson.dev/baseline=default-deny) that does not
+# actually cover BOTH Ingress and Egress is rejected. This is the "test the
+# behavior, not the existence" guard for R-NET-01 at the manifest layer -- an
+# object existing is not proof it denies (docs/14 principle 1).
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: validate-default-deny-shape
+  annotations:
+    policies.kyverno.io/title: Validate default-deny baseline shape
+    policies.kyverno.io/category: Network Isolation
+    policies.kyverno.io/severity: high
+    homelab.keithjackson.dev/requirements: R-NET-01
+    policies.kyverno.io/description: >-
+      A NetworkPolicy labelled as the default-deny baseline must set policyTypes
+      to include both Ingress and Egress. Rejects a baseline that silently leaves
+      a direction open.
+spec:
+  validationFailureAction: Enforce
+  background: true
+  rules:
+    - name: baseline-must-deny-both-directions
+      match:
+        any:
+          - resources:
+              kinds:
+                - NetworkPolicy
+              selector:
+                matchLabels:
+                  homelab.keithjackson.dev/baseline: default-deny
+      validate:
+        message: >-
+          A default-deny baseline NetworkPolicy must set spec.policyTypes to include
+          BOTH Ingress and Egress (R-NET-01, docs/03).
+        pattern:
+          spec:
+            policyTypes:
+              - Ingress
+              - Egress