# =============================================================================
# L0 STATIC — every authored admission policy is actually APPLIED  (R-SEC-01, R-SEC-02)
# Catalog: docs/14 L0 row ("Pre-apply, in CI") — runs WITHOUT a cluster.
#
# WHY THIS EXISTS. `kyverno test` proves a policy is CORRECT. Nothing proved it was DEPLOYED.
# platform/kyverno/ holds three lists and only platform-config/kustomization.yaml applies
# anything; the other two are a reference copy and a namespace+HelmRelease render root. On
# 2026-09-29 the R-SEC-02 boundary policy was added to the reference copy: it parsed, its
# kyverno test passed, the gate passed, Flux reported the tier Ready at the new revision — and
# the cluster ran the conformance-trigger ServiceAccount with nothing bounding it.
#
# WHOLE-REPO SCOPE, DELIBERATELY. The failure mode is a policy that is present but wired
# nowhere, which by definition touches no requirement the diff attributes. A path-scoped run
# would have skipped this check on the very commit that introduced the defect.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: admission-policies-actually-applied
  labels:
    conformance.home.k3s/R-SEC-01: "true"
    conformance.home.k3s/R-SEC-02: "true"
  annotations:
    conformance.home.k3s/requirements: "R-SEC-01,R-SEC-02"
    conformance.home.k3s/layer: "L0"
    conformance.home.k3s/scope: "whole-repo"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      Every ClusterPolicy authored under platform/kyverno/ is either referenced by
      platform-config/kustomization.yaml (so Flux applies it) or is a documented CI-only
      exemption that is genuinely not applied — so a policy cannot be authored, tested,
      green, and absent from the cluster.
spec:
  steps:
    - name: every-authored-policy-is-applied-or-documented-ci-only
      description: >-
        Enumerate the ClusterPolicy files under platform/kyverno/ and assert each is wired
        into the Kustomization that actually applies Kyverno CRs, or exempted with a reason.
      try:
        - script:
            content: bash ./check.sh