Jon Chery
255cde5002
P1-1 (correctness): run_platform.sh Step 5c now invokes the meta-policies
(block-on-any-critical, tagging-rules-agree) over the merged PCR list after
Step 5b, appending the meta-PCRs to pcr.json before the confidence signal
runs. Closes the D-118/D-119 declarative-critical-block gap (the
confidence_signal.py hard-override stays as defense-in-depth).
P1-2 (testing): test_meta_policies.py behavioral assertions strengthened —
test_no_critical_passes asserts no fails, test_critical_fail_present asserts
a non-pass result, test_pcrs_validate_against_schema validates output.
P1-3 (correctness): _smoke.json assertion rewritten from malformed
'{{ to_string(@) }}' to valid JMESPath '(regex_match(...))'.
---ci---
project: acdl
phase: 5
milestone: v1.25
status: execute
phase_role: final
---/ci---
30 lines
637 B
JSON
30 lines
637 B
JSON
{
|
|
"apiVersion": "json.kyverno.io/v1alpha1",
|
|
"kind": "ValidatingPolicy",
|
|
"metadata": {
|
|
"name": "require-contract-id",
|
|
"annotations": {
|
|
"nova.cloudinit.dev/severity": "high",
|
|
"title.policy.kyverno.io": "Require contract id"
|
|
}
|
|
},
|
|
"spec": {
|
|
"rules": [
|
|
{
|
|
"name": "require-id",
|
|
"validate": {
|
|
"message": "contract id is required",
|
|
"assert": {
|
|
"all": [
|
|
{
|
|
"check": {
|
|
"id": "(regex_match('^[a-z][a-z0-9-]{2,5}$', @))"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |