T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/tests/resources/generated-default-deny.yaml

@@ -0,0 +1,26 @@
+# Golden expected output of the require-default-deny-baseline generate rule when the
+# `app-ns` Namespace fixture is created. `kyverno test` compares the generated
+# NetworkPolicy against this file.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53

platform/kyverno/tests/resources/namespaces.yaml

@@ -0,0 +1,16 @@
+# Namespace fixtures. `app-ns` carries the application-namespace marker so the
+# namespaceSelector-scoped policies apply; `platform-ns` does not, proving that
+# platform/system namespaces are correctly OUT of scope.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: app-ns
+  labels:
+    homelab.keithjackson.dev/app-namespace: "true"
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: platform-ns
+  labels:
+    kubernetes.io/metadata.name: platform-ns

platform/kyverno/tests/resources/networkpolicies.yaml

@@ -0,0 +1,40 @@
+# NetworkPolicy fixtures for validate-default-deny-shape (R-NET-01).
+# The "good" baseline denies both directions; the "bad" baseline is labelled as the
+# baseline but only covers Ingress -- leaving egress open -- and must be rejected.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: good-baseline-np
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: bad-baseline-np
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  # Missing Egress -> egress is left wide open despite claiming to be the baseline.
+  policyTypes:
+    - Ingress
+  ingress: []

platform/kyverno/tests/resources/secrets.yaml

@@ -0,0 +1,25 @@
+# Secret fixtures for disallow-plaintext-secrets (R-SEC-01).
+# The "good" secret is shaped like a SOPS-encrypted manifest: values are ENC[...]
+# ciphertext and a top-level `sops` block (with a mac) is present. The "bad" secret
+# is plaintext with no `sops` block. NOTE: the ENC[...] strings below are fixtures,
+# not real ciphertext -- no plaintext secret material is present (docs/07 rule).
+apiVersion: v1
+kind: Secret
+metadata:
+  name: good-secret-sops
+  namespace: app-ns
+type: Opaque
+data:
+  password: ENC[AES256_GCM,data:Zm9vYmFy,iv:AAAA,tag:BBBB,type:str]
+sops:
+  mac: ENC[AES256_GCM,data:CCCC,iv:DDDD,tag:EEEE,type:str]
+  version: 3.8.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: bad-secret-plain
+  namespace: app-ns
+type: Opaque
+stringData:
+  password: hunter2-this-would-be-plaintext

platform/kyverno/tests/resources/workloads.yaml

@@ -0,0 +1,112 @@
+# Pod fixtures for the label + host-namespace policies. Pods (not Deployments) are
+# used so `kyverno test` result rows reference the base rule names directly; the
+# same rules reach Deployment/StatefulSet pod templates via pod-controller autogen
+# in CI and in-cluster.
+#
+# ---- COMPLIANT ----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: good-workload
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: internet
+    homelab.keithjackson.dev/auth-mode: oidc
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+# ---- egress-class violations (R-NET-05) ----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-egress-missing        # no egress-class label at all
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/auth-mode: oidc
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-egress-invalid        # egress-class not in {internet,vpn}
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: wan
+    homelab.keithjackson.dev/auth-mode: oidc
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+# ---- auth-mode violations (R-IDP-02) ----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-auth-missing          # no auth-mode label
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: vpn
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-auth-invalid          # auth-mode not in the enum
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: vpn
+    homelab.keithjackson.dev/auth-mode: basic
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+# ---- host-namespace / privilege violations (R-SEC-02) ----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-hostnetwork           # hostNetwork bypasses default-deny
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: internet
+    homelab.keithjackson.dev/auth-mode: none
+spec:
+  hostNetwork: true
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-privileged            # privileged container
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: internet
+    homelab.keithjackson.dev/auth-mode: none
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+      securityContext:
+        privileged: true
+---
+# ---- scope proof: same bare pod in a NON-app namespace must be SKIPPED ----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: platform-workload
+  namespace: platform-ns
+spec:
+  hostNetwork: true               # allowed here: platform ns is out of scope
+  containers:
+    - name: agent
+      image: registry.example/agent:1.0.0