jakman85andClaude Opus 4.8
08113ccfbb
The offline `kyverno test` CLI cannot resolve the Flux postBuild token
${KYVERNO_VALIDATION_ACTION} in validationFailureAction, so the 4 policies
carrying it failed to load and their result rows reported "Not found" (14/17
cases). Render a throwaway copy of platform/kyverno with the base/prod value
(Enforce) before `kyverno test` in both ci/l0.sh and scripts/run-l0.sh; this
does not change in-cluster enforcement.
Add tests/values.yaml supplying Namespace labels so the offline CLI resolves
namespaceSelector matches -- without it the R-SEC-02/R-NET-05/R-IDP-02 Pod
cases were silently EXCLUDED (vacuous), not evaluated.
Pin kyverno-json 0.0.3 in ci/versions.env (0.0.5 has no upstream release;
0.0.3 is what run-l0.sh and the devcontainer already use).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
27 lines
1.1 KiB
Bash
27 lines
1.1 KiB
Bash
# ci/versions.env — pinned tool versions (R-TEST-02: reproducible, version-pinned)
|
|
#
|
|
# Single source of truth for every tool the gate invokes. The Gitea Actions
|
|
# workflow and the local scripts both source this file so CI and a laptop run
|
|
# the exact same versions. Bump deliberately; a version change is a code change
|
|
# that must go through the normal feature-branch -> main gate.
|
|
#
|
|
# Owner: WS-GITOSS (CI). The Kyverno/Chainsaw versions MUST stay in lockstep with
|
|
# whatever platform/kyverno and conformance/ pin — see integration notes in README.
|
|
|
|
# L0 policy gate (Kyverno CLI) + ServiceDefinition validation (kyverno-json)
|
|
KYVERNO_VERSION="1.13.4"
|
|
KYVERNO_JSON_VERSION="0.0.3"
|
|
|
|
# L1/L2/L3 declarative runner (Chainsaw) — invoked via conformance/ entrypoint,
|
|
# pinned here so a local run matches CI even before the in-cluster Job exists.
|
|
CHAINSAW_VERSION="0.2.12"
|
|
|
|
# Lint / manifest tooling
|
|
YAMLLINT_VERSION="1.35.1"
|
|
KUBECTL_VERSION="1.31.4"
|
|
YQ_VERSION="4.44.6"
|
|
|
|
# ServiceDefinition JSON-Schema validation (schemas/validate.sh). Pip-installed;
|
|
# pinned here so CI and a laptop validate against the exact same validator.
|
|
CHECK_JSONSCHEMA_VERSION="0.29.4"
|