jakman85andClaude Opus 4.8
08113ccfbb
The offline `kyverno test` CLI cannot resolve the Flux postBuild token
${KYVERNO_VALIDATION_ACTION} in validationFailureAction, so the 4 policies
carrying it failed to load and their result rows reported "Not found" (14/17
cases). Render a throwaway copy of platform/kyverno with the base/prod value
(Enforce) before `kyverno test` in both ci/l0.sh and scripts/run-l0.sh; this
does not change in-cluster enforcement.
Add tests/values.yaml supplying Namespace labels so the offline CLI resolves
namespaceSelector matches -- without it the R-SEC-02/R-NET-05/R-IDP-02 Pod
cases were silently EXCLUDED (vacuous), not evaluated.
Pin kyverno-json 0.0.3 in ci/versions.env (0.0.5 has no upstream release;
0.0.3 is what run-l0.sh and the devcontainer already use).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
19 lines
805 B
YAML
19 lines
805 B
YAML
# Values for `kyverno test` -- supplies the Namespace LABELS the offline CLI needs to
|
|
# resolve `namespaceSelector` matches (R-SEC-02/R-NET-05/R-IDP-02 policies scope by the
|
|
# app-namespace label). Without this the engine cannot see a Namespace's labels for a
|
|
# Pod under test, so every namespaceSelector rule is silently EXCLUDED and the pass/fail
|
|
# assertions below become vacuous. These labels mirror resources/namespaces.yaml so the
|
|
# app-namespace pods are genuinely evaluated and the platform-namespace pod is genuinely
|
|
# out of scope (skip).
|
|
apiVersion: cli.kyverno.io/v1alpha1
|
|
kind: Values
|
|
metadata:
|
|
name: values
|
|
namespaceSelector:
|
|
- name: app-ns
|
|
labels:
|
|
homelab.keithjackson.dev/app-namespace: "true"
|
|
- name: platform-ns
|
|
labels:
|
|
kubernetes.io/metadata.name: platform-ns
|