0 Fork 0

Files

T

jakman85andClaude Opus 4.8 5521059c04 fix(kyverno): replace purged bitnami/kubectl cleanup image with bitnamilegacy

The kyverno chart's cleanup jobs (policyReportsCleanup, webhooksCleanup) default to
bitnami/kubectl:1.30.2, which Bitnami removed from Docker Hub (2024 catalog purge) ->
ImagePullBackOff. policyReportsCleanup is a Helm post-upgrade HOOK, so its failure
stalls every helm upgrade (5m timeout -> HelmRelease not-Ready -> platform Kustomization
blocked -> platform-config/apps cascade). Override both to Bitnami's relocated
bitnamilegacy/kubectl (identical image: /bin/bash + awk/wc/xargs + kubectl). Verified
via helm template that no bitnami/kubectl reference remains.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

2026-08-17 08:38:53 -05:00

helmrelease.yaml

fix(kyverno): replace purged bitnami/kubectl cleanup image with bitnamilegacy

2026-08-17 08:38:53 -05:00

kustomization.yaml

T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

2026-08-16 00:08:32 -05:00

namespace.yaml

T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

2026-08-16 00:08:32 -05:00

README.md

T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

2026-08-16 00:08:32 -05:00

secret-provenance.yaml

phase2-prep: per-component no-secret rollout + component hardening (author-first)

2026-08-16 21:34:57 -05:00

README.md

In-cluster admission enforcement (scaffolding — Phase 2 / T-2.7)

Installs Kyverno and runs the same L0 policies as an in-cluster admission controller, so a non-conforming resource that somehow bypassed CI still cannot be admitted (defense in depth — docs/07, ADR-0011). Not applied in Phase 0 (no cluster exists yet); this is scaffolding wired up in task T-2.7.

Enforcement COMPLEMENTS, never REPLACES, behavior tests

A policy admitting a manifest is not proof the runtime behaves (docs/14 principle 1, R-TEST-01). Kyverno confirms a resource is shaped correctly; it does not prove default-deny actually blocks a packet, that the VPN kill-switch fails closed, or that a PVC survives a rebuild. Those are proven only by the L2/L3 Chainsaw behavior and fault-injection tests (conformance/, ADR-0011), which remain mandatory. Admission is a gate, not a guarantee of behavior.

Authored once, shared

kustomization.yaml references the policy files in ../policies/ verbatim — the identical objects the CI kyverno test gate validates — plus the Kyverno install. No policy is forked between CI and admission, with one deliberate exception:

The one deliberate CI vs admission divergence — Secrets

../policies/disallow-plaintext-secrets.yaml (CI) requires a top-level sops block on the Secret manifest. Flux decrypts SOPS before admission, so that block is gone by the time the API server sees the Secret — the CI policy cannot run in-cluster. The admission equivalent is secret-provenance.yaml, which enforces provenance (Secret came from Flux / is an exempt controller Secret) instead of ciphertext. This is escalated in the T-0.5 report because docs/07's literal wording ("reject a plaintext Secret at admission") is not achievable post-decrypt.

Operational note (from ADR-0011)

Admission enforcement adds a failure mode: a bad policy can block legitimate reconciliation. Mitigations: policies ship with their own kyverno test suite (this directory's ../tests), roll out via GitOps, and the webhook failurePolicy: Fail is chosen so the system fails closed (coordination-protocol.md #8) — validate for bootstrap deadlocks in dev/test before prod.