jakman85andClaude Opus 4.8
08113ccfbb
The offline `kyverno test` CLI cannot resolve the Flux postBuild token
${KYVERNO_VALIDATION_ACTION} in validationFailureAction, so the 4 policies
carrying it failed to load and their result rows reported "Not found" (14/17
cases). Render a throwaway copy of platform/kyverno with the base/prod value
(Enforce) before `kyverno test` in both ci/l0.sh and scripts/run-l0.sh; this
does not change in-cluster enforcement.
Add tests/values.yaml supplying Namespace labels so the offline CLI resolves
namespaceSelector matches -- without it the R-SEC-02/R-NET-05/R-IDP-02 Pod
cases were silently EXCLUDED (vacuous), not evaluated.
Pin kyverno-json 0.0.3 in ci/versions.env (0.0.5 has no upstream release;
0.0.3 is what run-l0.sh and the devcontainer already use).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
54 lines
2.2 KiB
Bash
Executable File
54 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# L0 policy-as-code gate (T-0.5) -- the single command CI runs. No cluster required.
|
|
#
|
|
# Verifies:
|
|
# 1. Kyverno ClusterPolicies vs pass/fail resource fixtures (kyverno test)
|
|
# 2. ServiceDefinition shape vs valid/invalid payloads (kyverno-json scan)
|
|
#
|
|
# Version-pin the tools for reproducibility (docs/14, ADR-0011). Override via env.
|
|
set -euo pipefail
|
|
|
|
# --- pinned tool versions (bump via the normal update path; suite re-green is the gate) ---
|
|
KYVERNO_VERSION="${KYVERNO_VERSION:-v1.13.4}"
|
|
KYVERNO_JSON_VERSION="${KYVERNO_JSON_VERSION:-v0.0.3}"
|
|
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
cd "$HERE/.."
|
|
|
|
echo "== L0 gate: Kyverno CLI $KYVERNO_VERSION / kyverno-json $KYVERNO_JSON_VERSION =="
|
|
|
|
echo "-- [1/2] ClusterPolicy tests (kyverno test) --"
|
|
# The ClusterPolicies carry a Flux postBuild token in validationFailureAction
|
|
# (${KYVERNO_VALIDATION_ACTION}, substituted in-cluster from clusters/base/cluster-vars.yaml).
|
|
# The offline `kyverno test` CLI does not run Flux substitution, so render a throwaway copy
|
|
# with the base/prod value (Enforce) before testing — otherwise those policies fail to load
|
|
# and their result rows report "Not found". This does not change in-cluster enforcement.
|
|
: "${KYVERNO_VALIDATION_ACTION:=Enforce}"
|
|
L0_RENDER="$(mktemp -d)"
|
|
trap 'rm -rf "$L0_RENDER"' EXIT
|
|
cp -a . "$L0_RENDER/"
|
|
find "$L0_RENDER" -type f -name '*.yaml' -print0 \
|
|
| xargs -0 sed -i "s/\${KYVERNO_VALIDATION_ACTION}/${KYVERNO_VALIDATION_ACTION}/g"
|
|
kyverno test "$L0_RENDER/tests"
|
|
|
|
echo "-- [2/2] ServiceDefinition validation (kyverno-json scan) --"
|
|
kyverno-json scan \
|
|
--policy servicedefinition/validate-servicedefinition.yaml \
|
|
--payload servicedefinition/payloads/valid-plex.yaml \
|
|
--payload servicedefinition/payloads/valid-sonarr.yaml
|
|
|
|
fail=0
|
|
for f in servicedefinition/payloads/invalid-*.yaml; do
|
|
if kyverno-json scan \
|
|
--policy servicedefinition/validate-servicedefinition.yaml \
|
|
--payload "$f" >/dev/null 2>&1; then
|
|
echo "FAIL: expected $f to be REJECTED but it passed"
|
|
fail=1
|
|
else
|
|
echo "ok (rejected as expected): $f"
|
|
fi
|
|
done
|
|
[ "$fail" -eq 0 ] || { echo "L0 gate FAILED"; exit 1; }
|
|
|
|
echo "== L0 gate PASSED =="
|