# In-cluster enforcing bundle (SCAFFOLDING for T-2.7; not applied in Phase 0).
# Installs Kyverno and applies the SAME policies authored for the CI L0 gate as an
# admission controller -- authored once, shared between CLI and admission (ADR-0011).
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: kyverno
resources:
  - namespace.yaml
  - helmrelease.yaml
  # --- policies SHARED verbatim with the CI L0 gate ---
  - ../policies/require-default-deny-baseline.yaml
  - ../policies/validate-default-deny-shape.yaml
  - ../policies/restrict-host-namespaces.yaml
  - ../policies/require-egress-class-label.yaml
  - ../policies/require-auth-mode-label.yaml
  # --- secrets: the admission variant REPLACES the CI-only sops-block policy ---
  #     (../policies/disallow-plaintext-secrets.yaml is CI-only; see secret-provenance.yaml)
  - secret-provenance.yaml