jakman85andClaude Opus 4.8
bb2e9fc931
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
19 lines
880 B
YAML
19 lines
880 B
YAML
# In-cluster enforcing bundle (SCAFFOLDING for T-2.7; not applied in Phase 0).
|
|
# Installs Kyverno and applies the SAME policies authored for the CI L0 gate as an
|
|
# admission controller -- authored once, shared between CLI and admission (ADR-0011).
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
namespace: kyverno
|
|
resources:
|
|
- namespace.yaml
|
|
- helmrelease.yaml
|
|
# --- policies SHARED verbatim with the CI L0 gate ---
|
|
- ../policies/require-default-deny-baseline.yaml
|
|
- ../policies/validate-default-deny-shape.yaml
|
|
- ../policies/restrict-host-namespaces.yaml
|
|
- ../policies/require-egress-class-label.yaml
|
|
- ../policies/require-auth-mode-label.yaml
|
|
# --- secrets: the admission variant REPLACES the CI-only sops-block policy ---
|
|
# (../policies/disallow-plaintext-secrets.yaml is CI-only; see secret-provenance.yaml)
|
|
- secret-provenance.yaml
|