Jon Chery
ac18c98385
core/policy_engine.py: PolicyEngine Protocol (PEP 544, runtime_checkable)
+ PolicyEngineRegistry (selects from config.json.policy.engine) + NullEngine
fallback (NULL_ENGINE_INACTIVE when policy key absent).
adapters/kyverno-json/: KyvernoJsonEngine — shells to , translates
native output → list[dict] PCR records (engine: "kyverno", ruleId KJ_ prefix,
severity via nova.cloudinit.dev/severity annotation, default info).
is_configured() guards on → KJ_ENGINE_NOT_CONFIGURED SKIPPED PCR
(distinct from NullEngine). Defensive parsing (malformed → error PCR).
config.json: new object {engine: kyverno-json, policy_root}.
scripts/install-kyverno-json.sh: go install kj@latest (D-115).
CI (.gitea + .github): install Go + kj for policy-engine tests (best-effort;
tests skip when kj absent).
tests: 24 pass, 2 skip (kj not installed). 132 existing tests unchanged.
NullEngine satisfies PolicyEngine Protocol (G-Q8a — proves swap boundary).
---ci---
project: acdl
phase: 1
milestone: v1.25
status: execute
phase_role: execution
requirements:
covered: [REQ-291, REQ-292, REQ-293, REQ-294, REQ-308, REQ-309]
partial: []
---/ci---
30 lines
614 B
JSON
30 lines
614 B
JSON
{
|
|
"apiVersion": "json.kyverno.io/v1alpha1",
|
|
"kind": "ValidatingPolicy",
|
|
"metadata": {
|
|
"name": "require-contract-id",
|
|
"annotations": {
|
|
"nova.cloudinit.dev/severity": "high",
|
|
"title.policy.kyverno.io": "Require contract id"
|
|
}
|
|
},
|
|
"spec": {
|
|
"rules": [
|
|
{
|
|
"name": "require-id",
|
|
"validate": {
|
|
"message": "contract id is required",
|
|
"assert": {
|
|
"all": [
|
|
{
|
|
"check": {
|
|
"id": "{{ to_string(@) }}"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |