feat(P03 W4): pilot-readiness + settlement-finality kyverno-json policies (REQ-315, REQ-320)

REQ-320: policies/pilot-readiness/no-placeholder-account.json asserts account_id != "000000000000" over the env JSON (critical severity — a placeholder account drives a block band). Passes on dev (581513795199), fails on placeholder. REQ-315: policies/settlement-finality/all-matches- committed.json asserts all_committed == true over the settlement status JSON (critical severity). Authored + tested in v1.26; enforcement gates qa/prod/dr promotions, not dev (G-Q6 — dev all_committed is vacuously true). Both policy tests run against real kj (not skipped). ---ci--- project: acdl phase: 3 milestone: v1.26 status: execute wave: W4 ---
2026-08-18 22:36:57 +00:00
parent 51b886f3f6
commit e22661ab54
8 changed files with 257 additions and 0 deletions
@@ -0,0 +1,27 @@
+{
+  "apiVersion": "json.kyverno.io/v1alpha1",
+  "kind": "ValidatingPolicy",
+  "metadata": {
+    "name": "no-placeholder-account",
+    "annotations": {
+      "nova.cloudinit.dev/severity": "critical",
+      "title.policy.kyverno.io": "Env does not use a placeholder AWS account id"
+    }
+  },
+  "spec": {
+    "rules": [
+      {
+        "name": "no-placeholder-account",
+        "assert": {
+          "all": [
+            {
+              "check": {
+                "(account_id == '000000000000')": false
+              }
+            }
+          ]
+        }
+      }
+    ]
+  }
+}
@@ -0,0 +1,27 @@
+{
+  "apiVersion": "json.kyverno.io/v1alpha1",
+  "kind": "ValidatingPolicy",
+  "metadata": {
+    "name": "all-matches-committed",
+    "annotations": {
+      "nova.cloudinit.dev/severity": "critical",
+      "title.policy.kyverno.io": "All settlement matches are committed (finalized)"
+    }
+  },
+  "spec": {
+    "rules": [
+      {
+        "name": "all-matches-committed",
+        "assert": {
+          "all": [
+            {
+              "check": {
+                "(all_committed)": true
+              }
+            }
+          ]
+        }
+      }
+    ]
+  }
+}