Files

T

Jon Chery bb43d94563 verify(P1): state-bucket + Kyverno rebrand — 4-layer verify PASS + ship

VERIFY: structural — adapter.py:117 nova-tfstate-*; kyverno policy nova:*
labels; behavioral — 80 tests PASS + run_ci.sh 3-stage PASS; security —
emitted backend no longer points at a non-existent bucket; quality —
new test_adapt_emits_nova_state_bucket regression guard. REQ-165 complete.

---ci---
project: acdl
phase: 1
milestone: v1.16
status: complete
phase_role: execution
requirements:
  covered: [REQ-165]
  partial: []
---/ci---

2026-07-30 15:17:43 +00:00

3.1 KiB

Raw Blame History

Kyverno Adapter

The Kyverno adapter translates Kyverno PolicyReport results to the normalized ACDL PolicyCheckResult schema (engine: "kyverno"), mirroring the Checkov/Wiz adapter pattern.

What Kyverno is

Kyverno is a Kubernetes-native policy engine. It runs as an admission controller inside a cluster, validates / mutates / generates K8s resources against declarative ClusterPolicy rules, and publishes results to PolicyReport resources.

When to use it

Kyverno is the right engine when the platform emits Kubernetes manifests (a K8s-native stack). The ACDL platform today emits Terraform only (D-053), so this adapter is ready but inactive: it ships now so the schema path, severity/result mapping and sample policies are in place ahead of the GitOps reconciler that will emit K8s manifests (roadmap).

How the adapter translates PolicyReport results

kyverno_adapter.py <policyreport.json> <contract-id> reads a JSON file containing a Kyverno PolicyReport (or just its .results[] array) and emits a list of PolicyCheckResult dicts:

Kyverno PolicyReport result field	PolicyCheckResult field
`policy`	`ruleId` (default `KYVERNO_UNKNOWN`)
`severity`	`severity` (lower-cased, mapped)
`result`	`result` (`pass`/`fail`/`error` as-is, `warn`/`skip`→`skipped`)
`message`	`message`
`resource`	`resourceRef` + `evidence.resource`
`namespace`, `kind`, `name`	`evidence.*`

The adapter is read-only against a local JSON fixture; the GitOps reconciler is responsible for fetching the live PolicyReport and writing the file. When there are zero results, the adapter returns an empty list (unlike Wiz it does not synthesize a SKIPPED record — Kyverno not running is a deployment state, not a configuration gap).

Roadmap dependency

This adapter activates when the GitOps reconciler (roadmap) emits K8s manifests. Until then it is documentation-only; the pipeline does not invoke it. The engine: "kyverno" enum value is present in schemas/policy_check_result.schema.json so future records validate.

Sample policies

The policies/ directory holds three valid Kyverno ClusterPolicy manifests (documentation-only today — the platform does not run them):

disallow-privileged-containers.yml — fail pods with securityContext.privileged: true.
require-resource-labels.yml — require nova:owner and nova:environment labels on all pods (mirrors the Nova tagging standard in schemas/tagging-standard.json).
require-image-digests.yml — require container images to reference a digest (image@sha256:...), not a mutable tag.

Schema path

The output records validate against schemas/policy_check_result.schema.json (engine: "kyverno" was already in the enum and is retained in Phase 23).

3.1 KiB Raw Blame History