T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-08-16 00:08:32 -05:00
1 parent bb08d0e048
commit bb2e9fc931
@@ -0,0 +1,126 @@
+# L0 policy-as-code test suite -- runs in CI WITHOUT a cluster.
+#   Run from this directory:  kyverno test .
+# Each result row is tagged (in comments) with the requirement ID it proves.
+# Deterministic, hermetic, reproducible (docs/14 reproducibility contract).
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: platform-kyverno-l0
+policies:
+  - ../policies/require-default-deny-baseline.yaml
+  - ../policies/validate-default-deny-shape.yaml
+  - ../policies/disallow-plaintext-secrets.yaml
+  - ../policies/restrict-host-namespaces.yaml
+  - ../policies/require-egress-class-label.yaml
+  - ../policies/require-auth-mode-label.yaml
+resources:
+  - resources/namespaces.yaml
+  - resources/workloads.yaml
+  - resources/secrets.yaml
+  - resources/networkpolicies.yaml
+results:
+  # ---- R-NET-01: default-deny baseline is GENERATED for an app namespace ----
+  - policy: require-default-deny-baseline
+    rule: generate-default-deny
+    kind: Namespace
+    resources:
+      - app-ns
+    generatedResource: resources/generated-default-deny.yaml
+    result: pass
+
+  # ---- R-NET-01: a malformed baseline (egress left open) is rejected ----
+  - policy: validate-default-deny-shape
+    rule: baseline-must-deny-both-directions
+    kind: NetworkPolicy
+    resources:
+      - good-baseline-np
+    result: pass
+  - policy: validate-default-deny-shape
+    rule: baseline-must-deny-both-directions
+    kind: NetworkPolicy
+    resources:
+      - bad-baseline-np
+    result: fail
+
+  # ---- R-SEC-01: plaintext Secret rejected; SOPS-encrypted Secret admitted ----
+  - policy: disallow-plaintext-secrets
+    rule: secrets-must-be-sops-encrypted
+    kind: Secret
+    resources:
+      - good-secret-sops
+    result: pass
+  - policy: disallow-plaintext-secrets
+    rule: secrets-must-be-sops-encrypted
+    kind: Secret
+    resources:
+      - bad-secret-plain
+    result: fail
+
+  # ---- R-SEC-02: hostNetwork/hostPID/hostIPC rejected in app namespaces ----
+  - policy: restrict-host-namespaces
+    rule: disallow-host-namespaces
+    kind: Pod
+    resources:
+      - good-workload
+    result: pass
+  - policy: restrict-host-namespaces
+    rule: disallow-host-namespaces
+    kind: Pod
+    resources:
+      - bad-hostnetwork
+    result: fail
+  - policy: restrict-host-namespaces
+    rule: disallow-host-namespaces
+    kind: Pod
+    resources:
+      - platform-workload          # non-app namespace -> out of scope
+    result: skip
+  # ---- R-SEC-02: privileged container rejected ----
+  - policy: restrict-host-namespaces
+    rule: disallow-privileged-containers
+    kind: Pod
+    resources:
+      - good-workload
+    result: pass
+  - policy: restrict-host-namespaces
+    rule: disallow-privileged-containers
+    kind: Pod
+    resources:
+      - bad-privileged
+    result: fail
+
+  # ---- R-NET-05: egress-class label required and enum-checked ----
+  - policy: require-egress-class-label
+    rule: require-egress-class
+    kind: Pod
+    resources:
+      - good-workload
+    result: pass
+  - policy: require-egress-class-label
+    rule: require-egress-class
+    kind: Pod
+    resources:
+      - bad-egress-missing
+      - bad-egress-invalid
+    result: fail
+  - policy: require-egress-class-label
+    rule: require-egress-class
+    kind: Pod
+    resources:
+      - platform-workload          # non-app namespace -> out of scope
+    result: skip
+
+  # ---- R-IDP-02: auth-mode label required and enum-checked ----
+  - policy: require-auth-mode-label
+    rule: require-auth-mode
+    kind: Pod
+    resources:
+      - good-workload
+    result: pass
+  - policy: require-auth-mode-label
+    rule: require-auth-mode
+    kind: Pod
+    resources:
+      - bad-auth-missing
+      - bad-auth-invalid
+    result: fail