T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/servicedefinition/payloads/invalid-bad-dependency.yaml

@@ -0,0 +1,14 @@
+# INVALID: a dependency uses protocol 'sctp' (not tcp|udp) and an out-of-range port
+# (docs/13 dependencies shape). Rejected.
+name: baddep
+kind: container
+source:
+  image: registry.example/app
+exposure: internal
+egress: internet
+dependencies:
+  - to: plex
+    port: 70000
+    protocol: sctp
+auth:
+  mode: forward-auth

platform/kyverno/servicedefinition/payloads/invalid-bad-egress.yaml

@@ -0,0 +1,9 @@
+# INVALID: egress class 'wan' is not in {internet, vpn} (docs/03, docs/13). Rejected.
+name: badegress
+kind: container
+source:
+  image: registry.example/app
+exposure: internal
+egress: wan
+auth:
+  mode: forward-auth

platform/kyverno/servicedefinition/payloads/invalid-missing-image.yaml

@@ -0,0 +1,9 @@
+# INVALID: kind 'container' but no source.image (docs/13 requires an image ref for
+# container kind). Rejected.
+name: noimage
+kind: container
+source: {}
+exposure: internal
+egress: internet
+auth:
+  mode: forward-auth

platform/kyverno/servicedefinition/payloads/invalid-public-no-auth.yaml

@@ -0,0 +1,10 @@
+# INVALID: public exposure with auth.mode 'none' -> an unauthenticated public UI,
+# which docs/15 forbids ("no management UI sits unauthenticated"). Rejected.
+name: nakedui
+kind: container
+source:
+  image: registry.example/ui
+exposure: public
+egress: internet
+auth:
+  mode: none

platform/kyverno/servicedefinition/payloads/valid-plex.yaml

@@ -0,0 +1,22 @@
+# VALID ServiceDefinition (R-GITOPS-02). Modelled on catalog service #1 (plex,
+# docs/13): public, internet egress, native auth (Plex), longhorn + bulk storage.
+name: plex
+kind: container
+source:
+  image: plexinc/pms-docker
+exposure: public
+egress: internet
+storage:
+  - name: config
+    size: 10Gi
+    class: longhorn
+  - name: media
+    class: bulk
+auth:
+  mode: native
+update:
+  channel: stable
+  cadence: weekly
+  autoRollbackOnFailedHealth: true
+observability:
+  metrics: true

platform/kyverno/servicedefinition/payloads/valid-sonarr.yaml

@@ -0,0 +1,29 @@
+# VALID ServiceDefinition (R-GITOPS-02). Modelled on catalog service #2 (sonarr,
+# docs/13): internal, VPN egress + kill-switch, forward-auth, explicit dependencies.
+name: sonarr
+kind: container
+source:
+  image: lscr.io/linuxserver/sonarr
+exposure: internal
+egress: vpn
+storage:
+  - name: config
+    size: 5Gi
+    class: longhorn
+  - name: downloads
+    class: bulk
+dependencies:
+  - to: qbittorrent
+    port: 8080
+    protocol: tcp
+  - to: jackett
+    port: 9117
+    protocol: tcp
+auth:
+  mode: forward-auth
+  groups:
+    - media-users
+update:
+  channel: stable
+  cadence: weekly
+  autoRollbackOnFailedHealth: true