T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-08-16 00:08:32 -05:00
1 parent bb08d0e048
commit bb2e9fc931
@@ -0,0 +1,126 @@
+# L0 policy-as-code test suite -- runs in CI WITHOUT a cluster.
+#   Run from this directory:  kyverno test .
+# Each result row is tagged (in comments) with the requirement ID it proves.
+# Deterministic, hermetic, reproducible (docs/14 reproducibility contract).
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: platform-kyverno-l0
+policies:
+  - ../policies/require-default-deny-baseline.yaml
+  - ../policies/validate-default-deny-shape.yaml
+  - ../policies/disallow-plaintext-secrets.yaml
+  - ../policies/restrict-host-namespaces.yaml
+  - ../policies/require-egress-class-label.yaml
+  - ../policies/require-auth-mode-label.yaml
+resources:
+  - resources/namespaces.yaml
+  - resources/workloads.yaml
+  - resources/secrets.yaml
+  - resources/networkpolicies.yaml
+results:
+  # ---- R-NET-01: default-deny baseline is GENERATED for an app namespace ----
+  - policy: require-default-deny-baseline
+    rule: generate-default-deny
+    kind: Namespace
+    resources:
+      - app-ns
+    generatedResource: resources/generated-default-deny.yaml
+    result: pass
+
+  # ---- R-NET-01: a malformed baseline (egress left open) is rejected ----
+  - policy: validate-default-deny-shape
+    rule: baseline-must-deny-both-directions
+    kind: NetworkPolicy
+    resources:
+      - good-baseline-np
+    result: pass
+  - policy: validate-default-deny-shape
+    rule: baseline-must-deny-both-directions
+    kind: NetworkPolicy
+    resources:
+      - bad-baseline-np
+    result: fail
+
+  # ---- R-SEC-01: plaintext Secret rejected; SOPS-encrypted Secret admitted ----
+  - policy: disallow-plaintext-secrets
+    rule: secrets-must-be-sops-encrypted
+    kind: Secret
+    resources:
+      - good-secret-sops
+    result: pass
+  - policy: disallow-plaintext-secrets
+    rule: secrets-must-be-sops-encrypted
+    kind: Secret
+    resources:
+      - bad-secret-plain
+    result: fail
+
+  # ---- R-SEC-02: hostNetwork/hostPID/hostIPC rejected in app namespaces ----
+  - policy: restrict-host-namespaces
+    rule: disallow-host-namespaces
+    kind: Pod
+    resources:
+      - good-workload
+    result: pass
+  - policy: restrict-host-namespaces
+    rule: disallow-host-namespaces
+    kind: Pod
+    resources:
+      - bad-hostnetwork
+    result: fail
+  - policy: restrict-host-namespaces
+    rule: disallow-host-namespaces
+    kind: Pod
+    resources:
+      - platform-workload          # non-app namespace -> out of scope
+    result: skip
+  # ---- R-SEC-02: privileged container rejected ----
+  - policy: restrict-host-namespaces
+    rule: disallow-privileged-containers
+    kind: Pod
+    resources:
+      - good-workload
+    result: pass
+  - policy: restrict-host-namespaces
+    rule: disallow-privileged-containers
+    kind: Pod
+    resources:
+      - bad-privileged
+    result: fail
+
+  # ---- R-NET-05: egress-class label required and enum-checked ----
+  - policy: require-egress-class-label
+    rule: require-egress-class
+    kind: Pod
+    resources:
+      - good-workload
+    result: pass
+  - policy: require-egress-class-label
+    rule: require-egress-class
+    kind: Pod
+    resources:
+      - bad-egress-missing
+      - bad-egress-invalid
+    result: fail
+  - policy: require-egress-class-label
+    rule: require-egress-class
+    kind: Pod
+    resources:
+      - platform-workload          # non-app namespace -> out of scope
+    result: skip
+
+  # ---- R-IDP-02: auth-mode label required and enum-checked ----
+  - policy: require-auth-mode-label
+    rule: require-auth-mode
+    kind: Pod
+    resources:
+      - good-workload
+    result: pass
+  - policy: require-auth-mode-label
+    rule: require-auth-mode
+    kind: Pod
+    resources:
+      - bad-auth-missing
+      - bad-auth-invalid
+    result: fail
@@ -0,0 +1,26 @@
+# Golden expected output of the require-default-deny-baseline generate rule when the
+# `app-ns` Namespace fixture is created. `kyverno test` compares the generated
+# NetworkPolicy against this file.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
@@ -0,0 +1,16 @@
+# Namespace fixtures. `app-ns` carries the application-namespace marker so the
+# namespaceSelector-scoped policies apply; `platform-ns` does not, proving that
+# platform/system namespaces are correctly OUT of scope.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: app-ns
+  labels:
+    homelab.keithjackson.dev/app-namespace: "true"
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: platform-ns
+  labels:
+    kubernetes.io/metadata.name: platform-ns
@@ -0,0 +1,40 @@
+# NetworkPolicy fixtures for validate-default-deny-shape (R-NET-01).
+# The "good" baseline denies both directions; the "bad" baseline is labelled as the
+# baseline but only covers Ingress -- leaving egress open -- and must be rejected.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: good-baseline-np
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: bad-baseline-np
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  # Missing Egress -> egress is left wide open despite claiming to be the baseline.
+  policyTypes:
+    - Ingress
+  ingress: []
@@ -0,0 +1,25 @@
+# Secret fixtures for disallow-plaintext-secrets (R-SEC-01).
+# The "good" secret is shaped like a SOPS-encrypted manifest: values are ENC[...]
+# ciphertext and a top-level `sops` block (with a mac) is present. The "bad" secret
+# is plaintext with no `sops` block. NOTE: the ENC[...] strings below are fixtures,
+# not real ciphertext -- no plaintext secret material is present (docs/07 rule).
+apiVersion: v1
+kind: Secret
+metadata:
+  name: good-secret-sops
+  namespace: app-ns
+type: Opaque
+data:
+  password: ENC[AES256_GCM,data:Zm9vYmFy,iv:AAAA,tag:BBBB,type:str]
+sops:
+  mac: ENC[AES256_GCM,data:CCCC,iv:DDDD,tag:EEEE,type:str]
+  version: 3.8.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: bad-secret-plain
+  namespace: app-ns
+type: Opaque
+stringData:
+  password: hunter2-this-would-be-plaintext
@@ -0,0 +1,112 @@
+# Pod fixtures for the label + host-namespace policies. Pods (not Deployments) are
+# used so `kyverno test` result rows reference the base rule names directly; the
+# same rules reach Deployment/StatefulSet pod templates via pod-controller autogen
+# in CI and in-cluster.
+#
+# ---- COMPLIANT ----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: good-workload
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: internet
+    homelab.keithjackson.dev/auth-mode: oidc
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+# ---- egress-class violations (R-NET-05) ----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-egress-missing        # no egress-class label at all
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/auth-mode: oidc
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-egress-invalid        # egress-class not in {internet,vpn}
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: wan
+    homelab.keithjackson.dev/auth-mode: oidc
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+# ---- auth-mode violations (R-IDP-02) ----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-auth-missing          # no auth-mode label
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: vpn
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-auth-invalid          # auth-mode not in the enum
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: vpn
+    homelab.keithjackson.dev/auth-mode: basic
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+# ---- host-namespace / privilege violations (R-SEC-02) ----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-hostnetwork           # hostNetwork bypasses default-deny
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: internet
+    homelab.keithjackson.dev/auth-mode: none
+spec:
+  hostNetwork: true
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-privileged            # privileged container
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: internet
+    homelab.keithjackson.dev/auth-mode: none
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+      securityContext:
+        privileged: true
+---
+# ---- scope proof: same bare pod in a NON-app namespace must be SKIPPED ----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: platform-workload
+  namespace: platform-ns
+spec:
+  hostNetwork: true               # allowed here: platform ns is out of scope
+  containers:
+    - name: agent
+      image: registry.example/agent:1.0.0