Jon Chery
e22661ab54
REQ-320: policies/pilot-readiness/no-placeholder-account.json asserts account_id != "000000000000" over the env JSON (critical severity — a placeholder account drives a block band). Passes on dev (581513795199), fails on placeholder. REQ-315: policies/settlement-finality/all-matches- committed.json asserts all_committed == true over the settlement status JSON (critical severity). Authored + tested in v1.26; enforcement gates qa/prod/dr promotions, not dev (G-Q6 — dev all_committed is vacuously true). Both policy tests run against real kj (not skipped). ---ci--- project: acdl phase: 3 milestone: v1.26 status: execute wave: W4 ---
27 lines
559 B
JSON
27 lines
559 B
JSON
{
|
|
"apiVersion": "json.kyverno.io/v1alpha1",
|
|
"kind": "ValidatingPolicy",
|
|
"metadata": {
|
|
"name": "all-matches-committed",
|
|
"annotations": {
|
|
"nova.cloudinit.dev/severity": "critical",
|
|
"title.policy.kyverno.io": "All settlement matches are committed (finalized)"
|
|
}
|
|
},
|
|
"spec": {
|
|
"rules": [
|
|
{
|
|
"name": "all-matches-committed",
|
|
"assert": {
|
|
"all": [
|
|
{
|
|
"check": {
|
|
"(all_committed)": true
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |