# L0 policy-as-code test suite -- runs in CI WITHOUT a cluster.
#   Run from this directory:  kyverno test .
# Each result row is tagged (in comments) with the requirement ID it proves.
# Deterministic, hermetic, reproducible (docs/14 reproducibility contract).
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
  name: platform-kyverno-l0
# Namespace labels for namespaceSelector resolution offline (see values.yaml).
variables: values.yaml
policies:
  - ../policies/require-default-deny-baseline.yaml
  - ../policies/validate-default-deny-shape.yaml
  - ../policies/disallow-plaintext-secrets.yaml
  - ../policies/restrict-host-namespaces.yaml
  - ../policies/require-egress-class-label.yaml
  - ../policies/require-auth-mode-label.yaml
resources:
  - resources/namespaces.yaml
  - resources/workloads.yaml
  - resources/secrets.yaml
  - resources/networkpolicies.yaml
results:
  # ---- R-NET-01: default-deny baseline is GENERATED for an app namespace ----
  - policy: require-default-deny-baseline
    rule: generate-default-deny
    kind: Namespace
    resources:
      - app-ns
    generatedResource: resources/generated-default-deny.yaml
    result: pass

  # ---- R-NET-01: a malformed baseline (egress left open) is rejected ----
  - policy: validate-default-deny-shape
    rule: baseline-must-deny-both-directions
    kind: NetworkPolicy
    resources:
      - good-baseline-np
    result: pass
  - policy: validate-default-deny-shape
    rule: baseline-must-deny-both-directions
    kind: NetworkPolicy
    resources:
      - bad-baseline-np
    result: fail

  # ---- R-SEC-01: plaintext Secret rejected; SOPS-encrypted Secret admitted ----
  - policy: disallow-plaintext-secrets
    rule: secrets-must-be-sops-encrypted
    kind: Secret
    resources:
      - good-secret-sops
    result: pass
  - policy: disallow-plaintext-secrets
    rule: secrets-must-be-sops-encrypted
    kind: Secret
    resources:
      - bad-secret-plain
    result: fail

  # ---- R-SEC-02: hostNetwork/hostPID/hostIPC rejected in app namespaces ----
  - policy: restrict-host-namespaces
    rule: disallow-host-namespaces
    kind: Pod
    resources:
      - good-workload
    result: pass
  - policy: restrict-host-namespaces
    rule: disallow-host-namespaces
    kind: Pod
    resources:
      - bad-hostnetwork
    result: fail
  - policy: restrict-host-namespaces
    rule: disallow-host-namespaces
    kind: Pod
    resources:
      - platform-workload          # non-app namespace -> out of scope
    result: skip
  # ---- R-SEC-02: privileged container rejected ----
  - policy: restrict-host-namespaces
    rule: disallow-privileged-containers
    kind: Pod
    resources:
      - good-workload
    result: pass
  - policy: restrict-host-namespaces
    rule: disallow-privileged-containers
    kind: Pod
    resources:
      - bad-privileged
    result: fail

  # ---- R-NET-05: egress-class label required and enum-checked ----
  - policy: require-egress-class-label
    rule: require-egress-class
    kind: Pod
    resources:
      - good-workload
    result: pass
  - policy: require-egress-class-label
    rule: require-egress-class
    kind: Pod
    resources:
      - bad-egress-missing
      - bad-egress-invalid
    result: fail
  - policy: require-egress-class-label
    rule: require-egress-class
    kind: Pod
    resources:
      - platform-workload          # non-app namespace -> out of scope
    result: skip

  # ---- R-IDP-02: auth-mode label required and enum-checked ----
  - policy: require-auth-mode-label
    rule: require-auth-mode
    kind: Pod
    resources:
      - good-workload
    result: pass
  - policy: require-auth-mode-label
    rule: require-auth-mode
    kind: Pod
    resources:
      - bad-auth-missing
      - bad-auth-invalid
    result: fail