feat(ci): platform admissibility gate — apply live Kyverno policy sets to the rendered scaffold#72
Conversation
…s to the rendered scaffold Fixes #71. Part of #6 (theme 4). Applies the platform's rendered cluster-policies base and the shared kyverno-policies set to the rendered deploy/ scaffold with a pinned, checksummed kyverno CLI. Enforce violations fail (--warn-exit-code activates exit-1-on-failure; verified v1.18.2 behavior both directions locally), Audit-mode policies warn, generate + mutate-existing rules are filtered (cluster-state actions; need a live client), plain mutate rules are kept so validation mirrors the cluster's mutate-then-validate order. A fail-open guard requires at least one passing rule on the platform set. Policy checkouts are deliberately unpinned — drift is the signal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@codex review |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Readiness record (self-promotion per the merged constitution): the gate's mechanics were verified locally in both directions against the real policy sets (an Enforce violation exits 1; the clean scaffold exits 0 with audit warnings tolerated; |
1 participant
Why
The scaffold's promise is "admissible on day one", but nothing enforced it — drift against the platform's admission policies only surfaced when a fresh tenant bounced. With the shared policy repo now live, the policy landscape is also about to move, which is exactly when a mechanical gate earns its keep.
What
A new CI job renders the scaffold and applies the platform's live Kyverno admission policy set (plus the shared kyverno-policies set) to it: Enforce violations fail the PR, Audit policies warn, and a fail-open guard rejects a vacuous green. Verified locally in both directions against the real policy sets.
Fixes #71. Part of #6.