Jon Chery
ac18c98385
core/policy_engine.py: PolicyEngine Protocol (PEP 544, runtime_checkable)
+ PolicyEngineRegistry (selects from config.json.policy.engine) + NullEngine
fallback (NULL_ENGINE_INACTIVE when policy key absent).
adapters/kyverno-json/: KyvernoJsonEngine — shells to , translates
native output → list[dict] PCR records (engine: "kyverno", ruleId KJ_ prefix,
severity via nova.cloudinit.dev/severity annotation, default info).
is_configured() guards on → KJ_ENGINE_NOT_CONFIGURED SKIPPED PCR
(distinct from NullEngine). Defensive parsing (malformed → error PCR).
config.json: new object {engine: kyverno-json, policy_root}.
scripts/install-kyverno-json.sh: go install kj@latest (D-115).
CI (.gitea + .github): install Go + kj for policy-engine tests (best-effort;
tests skip when kj absent).
tests: 24 pass, 2 skip (kj not installed). 132 existing tests unchanged.
NullEngine satisfies PolicyEngine Protocol (G-Q8a — proves swap boundary).
---ci---
project: acdl
phase: 1
milestone: v1.25
status: execute
phase_role: execution
requirements:
covered: [REQ-291, REQ-292, REQ-293, REQ-294, REQ-308, REQ-309]
partial: []
---/ci---
35 lines
1.1 KiB
Bash
35 lines
1.1 KiB
Bash
#!/usr/bin/env bash
|
|
# scripts/install-kyverno-json.sh — install the kj CLI (v1.25, REQ-294)
|
|
#
|
|
# Installs the kyverno-json CLI (`kj`) via `go install` (D-115). The
|
|
# binary is a Go project — not a Python package. Cached via the Go
|
|
# module cache.
|
|
#
|
|
# Usage: bash scripts/install-kyverno-json.sh
|
|
# Exits 0 on success, 1 if Go is not installed, 2 if `kj version` fails.
|
|
set -euo pipefail
|
|
|
|
if ! command -v go >/dev/null 2>&1; then
|
|
echo "ERROR: Go toolchain not found. Install Go (https://go.dev/dl/) first." >&2
|
|
echo " kyverno-json is a Go binary — `go install` is the upstream-blessed path (D-115)." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Installing kyverno-json CLI (kj) via go install..."
|
|
GOBIN="${GOBIN:-${HOME}/go/bin}"
|
|
go install github.com/kyverno/kyverno-json/cmd/kj@latest
|
|
|
|
if ! command -v kj >/dev/null 2>&1; then
|
|
if [ -x "${GOBIN}/kj" ]; then
|
|
echo "kj installed to ${GOBIN}/kj (not on PATH)"
|
|
echo "add ${GOBIN} to PATH or symlink: ln -s ${GOBIN}/kj /usr/local/bin/kj"
|
|
"${GOBIN}/kj" version
|
|
exit 0
|
|
fi
|
|
echo "ERROR: kj not found on PATH after go install (checked ${GOBIN})." >&2
|
|
exit 2
|
|
fi
|
|
|
|
echo "kj installed:"
|
|
kj version
|
|
echo "DONE" |