Repository navigation
Raise scaffolded security posture to the platform's current baseline (CiliumNetworkPolicy + policy set) #67
Description
🤖 Generated by the Daily AI Engineer
Problem. The template scaffolds vanilla NetworkPolicy and a smaller Kyverno policy set, while the reference platform has standardized on CiliumNetworkPolicy everywhere and added further cluster policies (disallow-latest-tag, image verification, replica floor/ceiling, PDB drain-safety, recommended labels) plus a scoped security-exceptions framework. Fresh platforms start with yesterday's posture.
Proposed direction. Port the platform's network-policy standard and the generic subset of its additional cluster policies (org-specific image-verification and exceptions stay out or ship genericized/default-off), keeping the template bootstrap-able out of the box.
Rough size. L
Part of #24
Activity
devantler commentedon Jul 18, 2026
Decomposed the first portable security-policy slice as devantler-tech/kyverno-policies#20 and linked it as this issue's sub-issue.
Live revalidation at Platform Template
main(15646e9) found 32CiliumNetworkPolicyresources and zero vanillaNetworkPolicyresources, so that half of the original premise is already satisfied. The first remaining gap is the reference platform's image-tag audit. Its reusable behavior will land and be tested once in the shared catalog; consumer-specific exclusions and rollout remain here. The catalog policy is deliberately inert until a separate pinned Platform Template adoption change.devantler commentedon Jul 18, 2026
The shared catalog slice is delivered: devantler-tech/kyverno-policies#21 merged as verified commit ffff4f152f3efd940cc78d56d257925592409ce1, and its main CI plus CodeQL are green.
This keeps the catalog inert by design. The next increment on this parent is the separate Platform Template adoption: pin that immutable revision, select only disallow-latest-tag, preserve Audit/no shared exclusions, remove any duplicated local policy identity, and prove the rendered template contains exactly one policy.
devantler commentedon Jul 18, 2026
Delivery child #84 is complete via #85 (
cde05878304d77df263679ca17653dc25ff7573b). Platform Template now selects only the immutable shareddisallow-latest-tagpolicy, without importing the catalog root or duplicating local policy identities.Both Docker/local and Hetzner/prod provider renders contain exactly one identical policy with two
Auditrules and no exclusions. Both KSail workload validations, naming, observability-option, required CI, CodeQL, and exact-head review passed.This closes the reusable-policy adoption slice; parent #67 remains open for its remaining security-baseline work.
devantler commentedon Jul 19, 2026
Delivery child #94 is complete via #95 (
26ca5aece22b958cc4de0ff0c90b0ccd51fcc1a0). Platform Template now offers explicit local/prod profiles for the immutable sharedadd-recommended-labelspolicy while every default provider and cluster render remains unchanged.The CI gate pins the exact mutation contract and rejects mutable or duplicate sources, broadened workload scope, author-label overwrites, removed namespace exclusions, and weakened name guards. The operator guide now covers selection, the required push/update/reconcile activation sequence, and rollback. Parent #67 remains open for its remaining baseline slices.