Repository navigation
Teach the ARC transport proof to read the issuance policy as a ValidatingPolicy #5126
Description
🤖 Generated by the Agentic Engineer
Evidence and problem
The ARC transport proof (the live verifier behind the "Verify ARC transport" workflow, and its fixture test in CI's "Validate ARC transport proof boundaries" step) reads the certificate-issuance restriction as a ClusterPolicy: it fetches clusterpolicy restrict-arc-openbao-certificate, rebuilds the expected spec from ClusterPolicy defaults (rules[], admission, validationFailureAction, per-rule background and existing-violation flags), and requires a Ready condition. #5123 rewrites that policy as a ValidatingPolicy, which Kyverno 1.20 requires (#4996). After that rewrite the verifier and its test fail: the object kind is different, the spec has no rules, and a ValidatingPolicy's live status carries no conditions list (read on production 2026-10-20 from an existing one).
So the proof that the issuance restriction is deployed, enforcing and unchanged must learn the new kind before #5123 can merge.
Smallest useful change
Teach the verifier and its fixture test to read validatingpolicies.policies.kyverno.io/restrict-arc-openbao-certificate: compare its live spec with the source spec, recognise its readiness from the ValidatingPolicy status shape, and replace the ClusterPolicy-shaped negative cases with their ValidatingPolicy equivalents (admission disabled, background disabled, Audit instead of Deny, an added match condition or exclusion, fail-open failurePolicy, an unknown field). The listener policy stays a ClusterPolicy and keeps its current checks. Land it together with, or immediately before, #5123's policy rewrite so the proof never targets an object that does not exist.
Acceptance criteria
- The fixture test passes with the issuance policy as a
ValidatingPolicy, and every negative case still fails the proof. - The live verifier passes against production after the rewrite deploys.
- The listener policy checks are unchanged.
Priority High (blocks #5123 and so #4996), Effort Medium. Service class Risk reduction, inherited from #4996.
Activity
fix(arc): read the issuance restriction as a ValidatingPolicy in the …
devantler commentedon Oct 20, 2026
Delivered by #5124, merged 2026-10-20. That PR adapted
scripts/verify-arc-transport.shand its fixture test to readrestrict-arc-openbao-certificateas a ValidatingPolicy. The verifier now readsvalidatingpolicies.policies.kyverno.io, requires the deployed spec to equal the source, and requires.status.conditionStatus.ready == true, with negative cases for admission or background off, Audit,matchConditions, Ignore, an unknown field, and not ready. The CI fixture test passed at the merged head. Closing by hand because the PR body could carry only oneFixes.