T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/scripts/run-l0.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# L0 policy-as-code gate (T-0.5) -- the single command CI runs. No cluster required.
+#
+#   Verifies:
+#     1. Kyverno ClusterPolicies vs pass/fail resource fixtures  (kyverno test)
+#     2. ServiceDefinition shape vs valid/invalid payloads       (kyverno-json scan)
+#
+# Version-pin the tools for reproducibility (docs/14, ADR-0011). Override via env.
+set -euo pipefail
+
+# --- pinned tool versions (bump via the normal update path; suite re-green is the gate) ---
+KYVERNO_VERSION="${KYVERNO_VERSION:-v1.13.4}"
+KYVERNO_JSON_VERSION="${KYVERNO_JSON_VERSION:-v0.0.3}"
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$HERE/.."
+
+echo "== L0 gate: Kyverno CLI $KYVERNO_VERSION / kyverno-json $KYVERNO_JSON_VERSION =="
+
+echo "-- [1/2] ClusterPolicy tests (kyverno test) --"
+kyverno test ./tests
+
+echo "-- [2/2] ServiceDefinition validation (kyverno-json scan) --"
+kyverno-json scan \
+  --policy servicedefinition/validate-servicedefinition.yaml \
+  --payload servicedefinition/payloads/valid-plex.yaml \
+  --payload servicedefinition/payloads/valid-sonarr.yaml
+
+fail=0
+for f in servicedefinition/payloads/invalid-*.yaml; do
+  if kyverno-json scan \
+      --policy servicedefinition/validate-servicedefinition.yaml \
+      --payload "$f" >/dev/null 2>&1; then
+    echo "FAIL: expected $f to be REJECTED but it passed"
+    fail=1
+  else
+    echo "ok (rejected as expected): $f"
+  fi
+done
+[ "$fail" -eq 0 ] || { echo "L0 gate FAILED"; exit 1; }
+
+echo "== L0 gate PASSED =="