3 Commits

Include renames

Author	SHA1	Message	Date
jakman85andClaude Opus 4.8	22db5fdb63	kyverno: 3.3/v1.13 -> 3.9/v1.19 (stay-current) + CLI lockstep ... - HR chart 3.3.x -> 3.9.x (Kyverno v1.13.6 -> v1.19.0). - crds.install:false + CRDs pre-applied server-side (5.7 MB bundle exceeds kubectl's 256 KB annotation limit; Helm client-side apply would stall the platform Kustomization, kps-style). - CLI lockstep (ci/conformance/devcontainer versions.env + run-l0.sh default) -> 1.19.0. Pre-verified: v1.19.0 kyverno CLI passes the L0 suite 17/17 with the existing test format. - Policies are kyverno.io/v1 ClusterPolicy (stable API, unchanged in v1.19). Co-Authored-By: Claude Opus 4.8 <[email protected]>	2026-08-30 16:28:16 -05:00
jakman85andClaude Opus 4.8	08113ccfbb	ci(l0): fix kyverno test expectations for CLI 1.13.4; pin kyverno-json 0.0.3 ... The offline `kyverno test` CLI cannot resolve the Flux postBuild token ${KYVERNO_VALIDATION_ACTION} in validationFailureAction, so the 4 policies carrying it failed to load and their result rows reported "Not found" (14/17 cases). Render a throwaway copy of platform/kyverno with the base/prod value (Enforce) before `kyverno test` in both ci/l0.sh and scripts/run-l0.sh; this does not change in-cluster enforcement. Add tests/values.yaml supplying Namespace labels so the offline CLI resolves namespaceSelector matches -- without it the R-SEC-02/R-NET-05/R-IDP-02 Pod cases were silently EXCLUDED (vacuous), not evaluated. Pin kyverno-json 0.0.3 in ci/versions.env (0.0.5 has no upstream release; 0.0.3 is what run-l0.sh and the devcontainer already use). Co-Authored-By: Claude Opus 4.8 <[email protected]>	2026-08-25 15:57:29 -05:00
jakman85andClaude Opus 4.8	bb2e9fc931	T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02) ... Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-08-16 00:08:32 -05:00