/goal /ultracode-workflows [POL-1] land Kyverno as a Flux-reconciled component + primitive-independent baselines #39
Labels
No labels
bug
discussion
duplicate
enhancement
goal
help wanted
horizon:backlog
horizon:governance
horizon:mvp
invalid
operator-decision
question
roadmap
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Blocks
Depends on
#40 /goal /ultracode-workflows [POL-2] migrate overlayManifests governance → Kyverno generate policies (the real payoff)
open-platform/mitosis
#41 /goal /ultracode-workflows [POL-3] image provenance via Kyverno verifyImages + platform CI cosign signing
open-platform/mitosis
#42 /goal /ultracode-workflows [POL-4] policy-govern the secrets + domains + network invariants
open-platform/mitosis
#43 /goal /ultracode-workflows [POL-5] policy-govern the RBAC/identity invariants
open-platform/mitosis
Reference
open-platform/mitosis#39
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Track/Wave:
POL-1· Wave G3 · Size MRepos:
gitopsDepends on: POL-0, CI-1
Why
Policy-as-governance needs an admission controller before it can enforce anything. The baseline is independent of the other tracks and can land early as the foundation POL-2..5 attach to. Adding Kyverno is the cheap Flux seam — no germinate edit.
Scope
clusters/local/platform/kyverno/ (HelmRelease, cnpg-operator/cert-manager pattern) + a Flux Kustomization block dependsOn:[cert-manager], non-HA. Baseline ClusterPolicies: images only from git.$DOMAIN/node-local registry (reinforces image sovereignty), disallow privileged/hostPath, require resource limits, per-ns DOS bound. Scope policies to plat.sh/app-labeled namespaces, not cluster-wide (footprint). MEASURE and record actual RSS/CPU on the germination box — Kyverno's docs refuse a fixed number and headroom is tight on the 16GB depth-2 Mac.
Acceptance
Germinate a daughter; Kyverno Ready, CRDs present, no regression to app create/release; a privileged/non-sovereign-image pod is rejected; footprint recorded.
Notes
Gitops/Flux-only — no germinate edit, no overlay seam.
Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.
Audit (team-board): landed + live-verified, but one acceptance clause only holds post-Enforce — PROPOSING closure, operator's call.
Shipped: plat/gitops#4 (d3882df7) — kyverno HelmRelease (non-HA, webhook scoped to
plat.sh/appnamespaces) +kyverno/kyverno-policiesFlux Kustomizations + baselines. Live on today's fresh daughter: 10/10 Kustomizations first-try incl. kyverno + kyverno-policies, 12 ClusterPolicies Ready, app shipped first-try (no create/release regression). Footprint recorded on the PR #4 thread (livewb-policygermination).Probed live today (server dry-run in
plat--pulse--prod):restrictedenforces; Kyvernodisallow-privileged-hostpathis the Audit backstop — the PR's own design)So "a privileged/non-sovereign-image pod is rejected" is half-true by design: Audit-first is POL-0 Decision 3, and the Enforce flip is already named as #42/#43 remaining scope. Close if you agree the audit-first posture satisfies POL-1 with the flip tracked there; leave open if you read the acceptance as Kyverno-enforced rejection.
Closing per the 2026-07-02 close-proposal, accepted in the 2026-07-06 board cleanup.
Delivered: Kyverno landed as a Flux-reconciled component with primitive-independent baselines (plat/gitops#4, merged 2026-07-01), live-verified — 12 ClusterPolicies Ready on fresh germinations, activated by default via
trim_gitops_lean, no app regression. Audit-first posture per POL-0 (#38). The Enforce flip stays tracked in #42/#43 + plat/gitops PR #14 (ENFORCE.md checklist).