Files

T

Jon Chery 9421442afd verify(P2): user-facing ACDL→Nova sweep — 4-layer verify PASS + ship

VERIFY: structural — all user-facing strings Nova; behavioral — 79 tests
+ CI PASS; security — no creds; quality — new onboarding Nova-header test.
REQ-166 complete. Internal ship_phase.sh helper added.

---ci---
project: acdl
phase: 2
milestone: v1.16
status: complete
phase_role: execution
requirements:
  covered: [REQ-166]
  partial: []
---/ci---

2026-08-01 12:12:45 +00:00

3.1 KiB

Raw Blame History

Kyverno Adapter

The Kyverno adapter translates Kyverno PolicyReport results to the normalized Nova PolicyCheckResult schema (engine: "kyverno"), mirroring the Checkov/Wiz adapter pattern.

What Kyverno is

Kyverno is a Kubernetes-native policy engine. It runs as an admission controller inside a cluster, validates / mutates / generates K8s resources against declarative ClusterPolicy rules, and publishes results to PolicyReport resources.

When to use it

Kyverno is the right engine when the platform emits Kubernetes manifests (a K8s-native stack). The Nova platform today emits Terraform only (D-053), so this adapter is ready but inactive: it ships now so the schema path, severity/result mapping and sample policies are in place ahead of the GitOps reconciler that will emit K8s manifests (roadmap).

How the adapter translates PolicyReport results

kyverno_adapter.py <policyreport.json> <contract-id> reads a JSON file containing a Kyverno PolicyReport (or just its .results[] array) and emits a list of PolicyCheckResult dicts:

Kyverno PolicyReport result field	PolicyCheckResult field
`policy`	`ruleId` (default `KYVERNO_UNKNOWN`)
`severity`	`severity` (lower-cased, mapped)
`result`	`result` (`pass`/`fail`/`error` as-is, `warn`/`skip`→`skipped`)
`message`	`message`
`resource`	`resourceRef` + `evidence.resource`
`namespace`, `kind`, `name`	`evidence.*`

The adapter is read-only against a local JSON fixture; the GitOps reconciler is responsible for fetching the live PolicyReport and writing the file. When there are zero results, the adapter returns an empty list (unlike Wiz it does not synthesize a SKIPPED record — Kyverno not running is a deployment state, not a configuration gap).

Roadmap dependency

This adapter activates when the GitOps reconciler (roadmap) emits K8s manifests. Until then it is documentation-only; the pipeline does not invoke it. The engine: "kyverno" enum value is present in schemas/policy_check_result.schema.json so future records validate.

Sample policies

The policies/ directory holds three valid Kyverno ClusterPolicy manifests (documentation-only today — the platform does not run them):

disallow-privileged-containers.yml — fail pods with securityContext.privileged: true.
require-resource-labels.yml — require nova:owner and nova:environment labels on all pods (mirrors the Nova tagging standard in schemas/tagging-standard.json).
require-image-digests.yml — require container images to reference a digest (image@sha256:...), not a mutable tag.

Schema path

The output records validate against schemas/policy_check_result.schema.json (engine: "kyverno" was already in the enum and is retained in Phase 23).

3.1 KiB Raw Blame History