T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/tests/resources/workloads.yaml

@@ -0,0 +1,112 @@
+# Pod fixtures for the label + host-namespace policies. Pods (not Deployments) are
+# used so `kyverno test` result rows reference the base rule names directly; the
+# same rules reach Deployment/StatefulSet pod templates via pod-controller autogen
+# in CI and in-cluster.
+#
+# ---- COMPLIANT ----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: good-workload
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: internet
+    homelab.keithjackson.dev/auth-mode: oidc
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+# ---- egress-class violations (R-NET-05) ----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-egress-missing        # no egress-class label at all
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/auth-mode: oidc
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-egress-invalid        # egress-class not in {internet,vpn}
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: wan
+    homelab.keithjackson.dev/auth-mode: oidc
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+# ---- auth-mode violations (R-IDP-02) ----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-auth-missing          # no auth-mode label
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: vpn
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-auth-invalid          # auth-mode not in the enum
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: vpn
+    homelab.keithjackson.dev/auth-mode: basic
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+# ---- host-namespace / privilege violations (R-SEC-02) ----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-hostnetwork           # hostNetwork bypasses default-deny
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: internet
+    homelab.keithjackson.dev/auth-mode: none
+spec:
+  hostNetwork: true
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-privileged            # privileged container
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/egress-class: internet
+    homelab.keithjackson.dev/auth-mode: none
+spec:
+  containers:
+    - name: app
+      image: registry.example/app:1.0.0
+      securityContext:
+        privileged: true
+---
+# ---- scope proof: same bare pod in a NON-app namespace must be SKIPPED ----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: platform-workload
+  namespace: platform-ns
+spec:
+  hostNetwork: true               # allowed here: platform ns is out of scope
+  containers:
+    - name: agent
+      image: registry.example/agent:1.0.0