From bb43d9456320fced797b866d49ab430a53d8cdf1 Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Thu, 30 Jul 2026 15:17:43 +0000 Subject: [PATCH] =?UTF-8?q?verify(P1):=20state-bucket=20+=20Kyverno=20rebr?= =?UTF-8?q?and=20=E2=80=94=204-layer=20verify=20PASS=20+=20ship?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit VERIFY: structural — adapter.py:117 nova-tfstate-*; kyverno policy nova:* labels; behavioral — 80 tests PASS + run_ci.sh 3-stage PASS; security — emitted backend no longer points at a non-existent bucket; quality — new test_adapt_emits_nova_state_bucket regression guard. REQ-165 complete. ---ci--- project: acdl phase: 1 milestone: v1.16 status: complete phase_role: execution requirements: covered: [REQ-165] partial: [] ---/ci--- --- .ciagent/CHECKPOINT.json | 8 ++++---- adapters/kyverno/README.md | 4 ++-- .../kyverno/policies/require-resource-labels.yml | 14 +++++++------- adapters/terraform/adapter.py | 2 +- tests/test_adapter.py | 9 +++++++++ 5 files changed, 23 insertions(+), 14 deletions(-) diff --git a/.ciagent/CHECKPOINT.json b/.ciagent/CHECKPOINT.json index 293cdd6..749cdcc 100644 --- a/.ciagent/CHECKPOINT.json +++ b/.ciagent/CHECKPOINT.json @@ -1,9 +1,9 @@ { - "phase": 0, - "stage": "plan", + "phase": 1, + "stage": "execute", "milestone": "v1.16", - "phase_role": "pre_execution", + "phase_role": "execution", "attempts": 0, - "updated_at": "2026-07-30T15:15:00Z", + "updated_at": "2026-07-30T15:30:00Z", "milestone_complete": false } \ No newline at end of file diff --git a/adapters/kyverno/README.md b/adapters/kyverno/README.md index 72ccd80..313e49b 100644 --- a/adapters/kyverno/README.md +++ b/adapters/kyverno/README.md @@ -55,8 +55,8 @@ manifests (documentation-only today — the platform does not run them): - `disallow-privileged-containers.yml` — fail pods with `securityContext.privileged: true`. -- `require-resource-labels.yml` — require `acdl:owner` and - `acdl:environment` labels on all pods (mirrors the ACDL tagging standard +- `require-resource-labels.yml` — require `nova:owner` and + `nova:environment` labels on all pods (mirrors the Nova tagging standard in [`schemas/tagging-standard.json`](../../schemas/tagging-standard.json)). - `require-image-digests.yml` — require container images to reference a digest (`image@sha256:...`), not a mutable tag. diff --git a/adapters/kyverno/policies/require-resource-labels.yml b/adapters/kyverno/policies/require-resource-labels.yml index a58d559..aa89390 100644 --- a/adapters/kyverno/policies/require-resource-labels.yml +++ b/adapters/kyverno/policies/require-resource-labels.yml @@ -3,7 +3,7 @@ kind: ClusterPolicy metadata: name: require-resource-labels annotations: - policies.kyverno.io/title: Require ACDL Resource Labels + policies.kyverno.io/title: Require Nova Resource Labels policies.kyverno.io/category: Governance policies.kyverno.io/severity: medium policies.kyverno.io/subject: Pod @@ -11,27 +11,27 @@ spec: validationFailureAction: audit background: true rules: - - name: require-acdl-owner-label + - name: require-nova-owner-label match: any: - resources: kinds: - Pod validate: - message: "Pods must carry the acdl:owner label (ACDL tagging standard)." + message: "Pods must carry the nova:owner label (Nova tagging standard)." pattern: metadata: labels: - acdl:owner: "?*" - - name: require-acdl-environment-label + nova:owner: "?*" + - name: require-nova-environment-label match: any: - resources: kinds: - Pod validate: - message: "Pods must carry the acdl:environment label (ACDL tagging standard)." + message: "Pods must carry the nova:environment label (Nova tagging standard)." pattern: metadata: labels: - acdl:environment: "?*" \ No newline at end of file + nova:environment: "?*" \ No newline at end of file diff --git a/adapters/terraform/adapter.py b/adapters/terraform/adapter.py index ac03adb..8bfec20 100644 --- a/adapters/terraform/adapter.py +++ b/adapters/terraform/adapter.py @@ -114,7 +114,7 @@ def adapt(stack_instance, out_dir): stack_name = stack.get("name", "spike") environment = stack.get("environment", "dev") account_id = env.get_env("AWS_ACCOUNT_ID", "581513795199") - state_bucket = f"acdl-tfstate-{account_id}-us-east-1" + state_bucket = f"nova-tfstate-{account_id}-us-east-1" terraform_tf = ( 'terraform {\n' ' required_version = ">= 1.9, < 1.10"\n' diff --git a/tests/test_adapter.py b/tests/test_adapter.py index 0392eea..852e005 100644 --- a/tests/test_adapter.py +++ b/tests/test_adapter.py @@ -90,6 +90,15 @@ class TestModuleAssembly: assert 'backend "s3"' in terraform_tf assert 'spike/s3/dev/terraform.tfstate' in terraform_tf + def test_adapt_emits_nova_state_bucket(self, tmp_path): + """P1 (REQ-165): the emitted backend references nova-tfstate-* + (not acdl-tfstate-*); the live bucket was renamed in v1.15 P4.""" + instance = json.load(open(ROOT / "modules/l1/s3/instance.json")) + adapt(instance, str(tmp_path)) + terraform_tf = (tmp_path / "terraform.tf").read_text() + assert "nova-tfstate-" in terraform_tf + assert "acdl-tfstate-" not in terraform_tf + def test_adapt_emits_root_outputs(self, tmp_path): instance = json.load(open(ROOT / "modules/l1/s3/instance.json")) instance["outputs"] = {