jakman85andClaude Opus 5
8c7a770de2
PR #13 added conformance-trigger-job-shape.yaml to platform/kyverno/admission/ kustomization.yaml. That file applies NOTHING. Its own sibling says so: "kept as reference; THIS file is the buildable render root" -- and that render root (platform/kyverno/kustomization.yaml) ships only the namespace and the HelmRelease, noting that ClusterPolicies are applied a tier later, by platform-config, because they need the Kyverno CRDs first. So three lists exist and only platform-config/kustomization.yaml applies anything. The policy went into the wrong one and EVERYTHING WENT GREEN: the file parsed, kyverno test exercised it by path and passed, the merge gate passed, and Flux reported `platform` Ready at the new revision. Measured on prod afterwards: kubectl get clusterpolicy conformance-trigger-job-shape Error from server (NotFound) while ns conformance, the conformance-trigger ServiceAccount, its Role and its RoleBinding were all live. That is exactly the state that identity's own RBAC header says must never exist -- the trigger identity present with nothing bounding it. Blast radius was small only because no trigger kubeconfig exists yet, which is luck, not design. Wires the policy into platform-config (verified: the render goes from 7 ClusterPolicies to 8 and contains conformance-trigger-job-shape). CLOSES THE CLASS, which matters more than the instance. Adds the L0 check admission-policies-actually-applied: every ClusterPolicy file under platform/kyverno/ is either referenced by platform-config/kustomization.yaml or named in a CI_ONLY list with a reason -- and CI_ONLY may not name a policy that IS applied, so the exemption cannot rot in either direction. Declared scope whole-repo deliberately: a policy wired nowhere touches no requirement the diff attributes, so a path-scoped run would have skipped it on the exact commit that introduced the defect. Proven both ways, not assumed: with the fix reverted -> FAIL, naming conformance-trigger-job-shape as never applied with the fix -> PASS, 9 policy files, 8 applied, 1 CI-only with a reason `kyverno test` proves a policy is CORRECT. This proves it is DEPLOYED. Nothing did before. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
43 lines
2.2 KiB
YAML
43 lines
2.2 KiB
YAML
# =============================================================================
|
|
# L0 STATIC — every authored admission policy is actually APPLIED (R-SEC-01, R-SEC-02)
|
|
# Catalog: docs/14 L0 row ("Pre-apply, in CI") — runs WITHOUT a cluster.
|
|
#
|
|
# WHY THIS EXISTS. `kyverno test` proves a policy is CORRECT. Nothing proved it was DEPLOYED.
|
|
# platform/kyverno/ holds three lists and only platform-config/kustomization.yaml applies
|
|
# anything; the other two are a reference copy and a namespace+HelmRelease render root. On
|
|
# 2026-09-29 the R-SEC-02 boundary policy was added to the reference copy: it parsed, its
|
|
# kyverno test passed, the gate passed, Flux reported the tier Ready at the new revision — and
|
|
# the cluster ran the conformance-trigger ServiceAccount with nothing bounding it.
|
|
#
|
|
# WHOLE-REPO SCOPE, DELIBERATELY. The failure mode is a policy that is present but wired
|
|
# nowhere, which by definition touches no requirement the diff attributes. A path-scoped run
|
|
# would have skipped this check on the very commit that introduced the defect.
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: admission-policies-actually-applied
|
|
labels:
|
|
conformance.home.k3s/R-SEC-01: "true"
|
|
conformance.home.k3s/R-SEC-02: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-SEC-01,R-SEC-02"
|
|
conformance.home.k3s/layer: "L0"
|
|
conformance.home.k3s/scope: "whole-repo"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/executable: "true"
|
|
conformance.home.k3s/intent: >-
|
|
Every ClusterPolicy authored under platform/kyverno/ is either referenced by
|
|
platform-config/kustomization.yaml (so Flux applies it) or is a documented CI-only
|
|
exemption that is genuinely not applied — so a policy cannot be authored, tested,
|
|
green, and absent from the cluster.
|
|
spec:
|
|
steps:
|
|
- name: every-authored-policy-is-applied-or-documented-ci-only
|
|
description: >-
|
|
Enumerate the ClusterPolicy files under platform/kyverno/ and assert each is wired
|
|
into the Kustomization that actually applies Kyverno CRs, or exempted with a reason.
|
|
try:
|
|
- script:
|
|
content: bash ./check.sh
|