diff --git a/adapters/kyverno/kyverno_adapter.py b/adapters/kyverno/kyverno_adapter.py index d0a5016..791fcf5 100644 --- a/adapters/kyverno/kyverno_adapter.py +++ b/adapters/kyverno/kyverno_adapter.py @@ -8,13 +8,16 @@ v1.9 (REQ-111): the translator is fleshed out — full PolicyReport → PolicyCheckResult mapping with severity + skip-with-reason handling. It remains inactive for Terraform-only stacks (guard preserved — emits a single SKIPPED `KYVERNO_INACTIVE_TF_STACK` record when no K8s manifests). -A `--kube-version` stub is parsed but not yet used (for future GitOps). +A `--kube-version` flag was previously parsed but never used. It has been +removed (v1.14, G-103) to resolve the stub. Version-aware policy selection +will be added when the GitOps reconciler emits K8s manifests (D-053 +roadmap). The adapter is inactive for Terraform-only stacks today. D-053: the platform emits Terraform, not K8s manifests. This adapter activates when the GitOps reconciler (roadmap) emits K8s manifests. Sample policies are included as documentation at adapters/kyverno/policies/. -CLI: kyverno_adapter.py [--kube-version ] +CLI: kyverno_adapter.py """ import datetime @@ -100,7 +103,7 @@ def _emit_inactive_tf(contract_id): } -def adapt(policyreport_json_path, contract_id, kube_version=None): +def adapt(policyreport_json_path, contract_id): with open(policyreport_json_path, "r", encoding="utf-8") as fh: data = json.load(fh) out = [] @@ -112,8 +115,6 @@ def adapt(policyreport_json_path, contract_id, kube_version=None): out.append(_to_pcr(entry, contract_id)) if not out: out.append(_emit_inactive_tf(contract_id)) - # kube_version is parsed but not yet used (future GitOps reconciler). - _ = kube_version return out @@ -123,14 +124,8 @@ def adapt_inactive(contract_id): if __name__ == "__main__": - kube_ver = None args = sys.argv[1:] - if "--kube-version" in args: - idx = args.index("--kube-version") - if idx + 1 < len(args): - kube_ver = args[idx + 1] - args = args[:idx] + args[idx + 2:] if len(args) != 2: - print("usage: kyverno_adapter.py [--kube-version ]", file=sys.stderr) + print("usage: kyverno_adapter.py ", file=sys.stderr) sys.exit(2) - print(json.dumps(adapt(args[0], args[1], kube_version=kube_ver), indent=2)) \ No newline at end of file + print(json.dumps(adapt(args[0], args[1]), indent=2)) \ No newline at end of file diff --git a/tests/test_kyverno_adapter.py b/tests/test_kyverno_adapter.py index 0cd168d..8be9c75 100644 --- a/tests/test_kyverno_adapter.py +++ b/tests/test_kyverno_adapter.py @@ -211,11 +211,13 @@ class TestFleshedOutTranslator: assert pcrs[0]["result"] == "skipped" assert "Terraform" in pcrs[0]["message"] - def test_kube_version_parsed(self, tmp_path): - """--kube-version is parsed but not yet used (future GitOps).""" + def test_kube_version_removed(self, tmp_path): + """v1.14 (G-103): --kube-version flag removed; adapt() no longer + accepts kube_version parameter. Version-aware policy selection + deferred to GitOps reconciler (D-053).""" f = tmp_path / "k.json" f.write_text(json.dumps({"results": [ {"policy": "p", "rule": "r", "severity": "low", "result": "pass", "resource": "x"}, ]})) - results = adapt(str(f), "c8", kube_version="1.28") + results = adapt(str(f), "c8") assert len(results) == 1