/goal /ultracode-workflows [POL-2] migrate overlayManifests governance → Kyverno generate policies (the real payoff) #40

Closed
opened 2026-07-01 02:03:50 +00:00 by plat · 3 comments
Owner

Track/Wave: POL-2 · Wave G4 · Size L
Repos: gitops, mcp
Depends on: POL-1, POL-0

Why

Where 'amend policy → software reshapes deterministically' becomes concrete: moves governance from imperative TS template strings (rendered once, no drift correction) to declarative, reviewable, drift-corrected CRs.

Scope

Author ClusterPolicy generate rules keyed on the plat.sh/app namespace label that clone+synchronize the ResourceQuota, LimitRange, and default-deny NetworkPolicy currently hand-rendered at server.ts:2378-2534, then REMOVE those blocks from overlayManifests (sequence remove-AFTER-verify — never two owners of one NetworkPolicy at once). Keep genuinely per-app data (Ingress host, per-app allow rules, CNPG) in the renderer.

Acceptance

On a germinated granddaughter, a created app's quota/netpol exist and match policy; manually DELETE a generated NetworkPolicy and Kyverno restores it — the 'policy governs, not convention' proof.

Notes

Trims the server.ts overlay renderer — coordinate with the overlay-seam chain.


Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `POL-2` · Wave **G4** · Size **L** **Repos:** `gitops`, `mcp` **Depends on:** POL-1, POL-0 ## Why Where 'amend policy → software reshapes deterministically' becomes concrete: moves governance from imperative TS template strings (rendered once, no drift correction) to declarative, reviewable, drift-corrected CRs. ## Scope Author ClusterPolicy `generate` rules keyed on the plat.sh/app namespace label that clone+synchronize the ResourceQuota, LimitRange, and default-deny NetworkPolicy currently hand-rendered at server.ts:2378-2534, then REMOVE those blocks from overlayManifests (sequence remove-AFTER-verify — never two owners of one NetworkPolicy at once). Keep genuinely per-app data (Ingress host, per-app allow rules, CNPG) in the renderer. ## Acceptance On a germinated granddaughter, a created app's quota/netpol exist and match policy; manually DELETE a generated NetworkPolicy and Kyverno restores it — the 'policy governs, not convention' proof. ## Notes **Trims the server.ts overlay renderer — coordinate with the overlay-seam chain.** --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*
Author
Owner

Audit (team-board): merged + live acceptance proof — closing.

Shipped: plat/gitops#6 (6d63d8fe) — plat-ns-resource-governance + plat-ns-network-governance generate policies (synchronize: true, specs byte-identical to the old overlay render) · plat/mcp#8 (d008f8bc) — overlay trim, remove-after-verify so there is one owner per resource.

Acceptance run live today on the fresh daughter (k3d plat.local, ns plat--pulse--prod):

  • created app's governance exists AND is policy-owned: tenant-quota ResourceQuota, tenant-defaults LimitRange, default-deny/allow-ingress-traefik/allow-ingress-from-workflows/allow-egress NetworkPolicies — all labeled generate.kyverno.io/policy-name + plat.sh/policy-track: pol-2
  • drift-heal: kubectl delete networkpolicy default-deny → Kyverno REGENERATED it in <2s (fresh creationTimestamp, generated by plat-ns-network-governance) — the "policy governs, not convention" proof

Caveat, tracked elsewhere: proof is on a depth-1 daughter; a depth-2 granddaughter carries the policy stack only after the #62 reseed (PR #65, open — closes #62 on merge). Cross-repo delivery (gitops/mcp) can't auto-close this issue — manual close.

Audit (team-board): merged + live acceptance proof — closing. **Shipped:** plat/gitops#6 (6d63d8fe) — `plat-ns-resource-governance` + `plat-ns-network-governance` generate policies (`synchronize: true`, specs byte-identical to the old overlay render) · plat/mcp#8 (d008f8bc) — overlay trim, remove-after-verify so there is one owner per resource. **Acceptance run live today** on the fresh daughter (k3d `plat.local`, ns `plat--pulse--prod`): - created app's governance exists AND is policy-owned: `tenant-quota` ResourceQuota, `tenant-defaults` LimitRange, `default-deny`/`allow-ingress-traefik`/`allow-ingress-from-workflows`/`allow-egress` NetworkPolicies — all labeled `generate.kyverno.io/policy-name` + `plat.sh/policy-track: pol-2` - drift-heal: `kubectl delete networkpolicy default-deny` → Kyverno REGENERATED it in <2s (fresh creationTimestamp, generated by `plat-ns-network-governance`) — the "policy governs, not convention" proof Caveat, tracked elsewhere: proof is on a depth-1 daughter; a depth-2 granddaughter carries the policy stack only after the #62 reseed (PR #65, open — closes #62 on merge). Cross-repo delivery (gitops/mcp) can't auto-close this issue — manual close.
Author
Owner

Addendum: Forgejo refuses this close while the native blockedBy #39 is open (412: cannot close this issue because it still has open dependencies). The acceptance evidence above stands; the audit-first question on #39 is the only thing holding both. One decision there closes the pair — if you accept the POL-0 audit-first posture on #39, close #39 then this.

Addendum: Forgejo refuses this close while the native `blockedBy` #39 is open (`412: cannot close this issue because it still has open dependencies`). The acceptance evidence above stands; the audit-first question on #39 is the only thing holding both. One decision there closes the pair — if you accept the POL-0 audit-first posture on #39, close #39 then this.
Author
Owner

Closing: fully delivered and validated. Overlay governance migrated to Kyverno generate policies via plat/gitops#6 + plat/mcp#8 (merged 2026-07-01), with live acceptance proof (generated quota/limits/netpols, drift-heal <2s) and depth-2 evidence on #46 (12 ClusterPolicies at both hops; reseed #65 resolved the seed caveat). The earlier close attempt was 412-blocked only by the #39 dependency, which is now closed.

Closing: fully delivered and validated. Overlay governance migrated to Kyverno `generate` policies via plat/gitops#6 + plat/mcp#8 (merged 2026-07-01), with live acceptance proof (generated quota/limits/netpols, drift-heal <2s) and depth-2 evidence on #46 (12 ClusterPolicies at both hops; reseed #65 resolved the seed caveat). The earlier close attempt was 412-blocked only by the #39 dependency, which is now closed.
plat closed this issue 2026-07-06 14:52:04 +00:00
Sign in to join this conversation.
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference
open-platform/mitosis#40
No description provided.