jakman85andClaude Opus 4.8
428361f8c5
The prior integration commit enabled kyverno in the platform render, but (a) the admission bundle used ../policies refs that fail default kustomize load restrictions, and (b) admission enforcement is Phase 2 (T-2.7), not Phase 0. Fix: platform/kyverno/kustomization.yaml now lists resources with downward paths (builds standalone); platform/kustomization.yaml re-defers kyverno with a Phase-2 note. All Phase-0 gates green: kustomize (platform, platform/kyverno, dev), schema validation, conformance scaffold. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
29 lines
1.2 KiB
YAML
29 lines
1.2 KiB
YAML
---
|
|
# Top-level platform kustomization — the entrypoint the Flux `platform` Kustomization renders
|
|
# (clusters/base/platform.yaml, path: ./platform).
|
|
#
|
|
# Phase 0 scaffolding: lists every platform component EXCEPT kyverno (owned by the policy engineer,
|
|
# WS-TEST — see platform/README.md).
|
|
#
|
|
# ⚠️ INTEGRATION TODO(PM): once platform/kyverno/ is authored by the policy engineer, uncomment the
|
|
# `- kyverno` line below. Keep it FIRST so admission policies are present before other components
|
|
# reconcile. This workstream must NOT create files under platform/kyverno/.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
# - kyverno # DEFERRED to Phase 2 (T-2.7): admission enforcement needs a cluster.
|
|
# Scaffolding is present & buildable at platform/kyverno/; enable it first
|
|
# (before other components) when T-2.7 activates. Kyverno's CI L0 gate is
|
|
# already live now via .gitea/ + ci/ (no cluster needed).
|
|
- cilium
|
|
- longhorn
|
|
- cert-manager
|
|
- externaldns
|
|
- gateway
|
|
- monitoring
|
|
- velero
|
|
- kubevirt
|
|
- image-automation
|
|
- keycloak
|
|
- oauth2-proxy
|