# SCAFFOLDING for a later phase (Phase 2, task T-2.7) -- NOT applied in Phase 0
# (no cluster exists yet). Installs Kyverno so the SAME L0 policies run in-cluster
# as an admission controller (defense in depth per docs/07, ADR-0011). Flux
# HelmRelease skeleton; chart/app versions are pinned and bumped via the update path.
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: kyverno
  namespace: kyverno
spec:
  interval: 24h
  url: https://kyverno.github.io/kyverno/
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: kyverno
  namespace: kyverno
spec:
  interval: 1h
  chart:
    spec:
      chart: kyverno
      version: "3.3.x"            # pin to the exact chart the operator vendors
      sourceRef:
        kind: HelmRepository
        name: kyverno
        namespace: kyverno
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    # HA admission controller so a single pod restart cannot open an enforcement gap.
    admissionController:
      replicas: 3
    backgroundController:
      enabled: true               # needed for generate (default-deny baseline) + sync
    reportsController:
      enabled: true
    cleanupController:
      enabled: true
    # Fail-CLOSED: if the webhook is unreachable, reject rather than silently admit
    # non-conforming resources (coordination-protocol.md #8). Tune per-resource in
    # the policies' webhook config if a bootstrap deadlock appears.
    config:
      webhooks:
        - failurePolicy: Fail