/goal /ultracode-workflows [POL-2] migrate overlayManifests governance → Kyverno generate policies (the real payoff) #40
Labels
No labels
bug
discussion
duplicate
enhancement
goal
help wanted
horizon:backlog
horizon:governance
horizon:mvp
invalid
operator-decision
question
roadmap
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Blocks
Depends on
Reference
open-platform/mitosis#40
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Track/Wave:
POL-2· Wave G4 · Size LRepos:
gitops,mcpDepends on: POL-1, POL-0
Why
Where 'amend policy → software reshapes deterministically' becomes concrete: moves governance from imperative TS template strings (rendered once, no drift correction) to declarative, reviewable, drift-corrected CRs.
Scope
Author ClusterPolicy
generaterules keyed on the plat.sh/app namespace label that clone+synchronize the ResourceQuota, LimitRange, and default-deny NetworkPolicy currently hand-rendered at server.ts:2378-2534, then REMOVE those blocks from overlayManifests (sequence remove-AFTER-verify — never two owners of one NetworkPolicy at once). Keep genuinely per-app data (Ingress host, per-app allow rules, CNPG) in the renderer.Acceptance
On a germinated granddaughter, a created app's quota/netpol exist and match policy; manually DELETE a generated NetworkPolicy and Kyverno restores it — the 'policy governs, not convention' proof.
Notes
Trims the server.ts overlay renderer — coordinate with the overlay-seam chain.
Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.
Audit (team-board): merged + live acceptance proof — closing.
Shipped: plat/gitops#6 (6d63d8fe) —
plat-ns-resource-governance+plat-ns-network-governancegenerate policies (synchronize: true, specs byte-identical to the old overlay render) · plat/mcp#8 (d008f8bc) — overlay trim, remove-after-verify so there is one owner per resource.Acceptance run live today on the fresh daughter (k3d
plat.local, nsplat--pulse--prod):tenant-quotaResourceQuota,tenant-defaultsLimitRange,default-deny/allow-ingress-traefik/allow-ingress-from-workflows/allow-egressNetworkPolicies — all labeledgenerate.kyverno.io/policy-name+plat.sh/policy-track: pol-2kubectl delete networkpolicy default-deny→ Kyverno REGENERATED it in <2s (fresh creationTimestamp, generated byplat-ns-network-governance) — the "policy governs, not convention" proofCaveat, tracked elsewhere: proof is on a depth-1 daughter; a depth-2 granddaughter carries the policy stack only after the #62 reseed (PR #65, open — closes #62 on merge). Cross-repo delivery (gitops/mcp) can't auto-close this issue — manual close.
Addendum: Forgejo refuses this close while the native
blockedBy#39 is open (412: cannot close this issue because it still has open dependencies). The acceptance evidence above stands; the audit-first question on #39 is the only thing holding both. One decision there closes the pair — if you accept the POL-0 audit-first posture on #39, close #39 then this.Closing: fully delivered and validated. Overlay governance migrated to Kyverno
generatepolicies via plat/gitops#6 + plat/mcp#8 (merged 2026-07-01), with live acceptance proof (generated quota/limits/netpols, drift-heal <2s) and depth-2 evidence on #46 (12 ClusterPolicies at both hops; reseed #65 resolved the seed caveat). The earlier close attempt was 412-blocked only by the #39 dependency, which is now closed.