feat(kyverno): migrate restrict-arc-openbao-certificate to ValidatingPolicy

[devantler]

🤖 Generated by the Agentic Engineer

Why

The next Kyverno release removes the older policy kind. The rule that stops any namespace other than OpenBao's from getting a certificate from the authority OpenBao's own certificate comes from still uses that kind, so on upgrade that impersonation path would silently open.

What

The same rule is rewritten in the newer policy kind and keeps blocking, with the same scope. The production check that proves this rule is deployed, blocking and unchanged now reads it in its new form, with the same failure cases. Its test also covers same-named authorities that are local to one namespace, which stay out of scope.

Fixes #5123

👉 After merge/promotion: also close the proof-update issue linked from #5123, which this change delivers.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: bee91fb8-7bb6-4561-9b11-3f363ccbdc3b

📥 Commits

Reviewing files that changed from the base of the PR and between afb4a0b and bd2a79f.

📒 Files selected for processing: 4

• k8s/providers/hetzner/infrastructure/cluster-policies/restrict-arc-openbao-certificate.yaml
• tests/policy-failure-actions.json
• tests/restrict-arc-openbao-certificate/kyverno-test.yaml
• tests/restrict-arc-openbao-certificate/resources.yaml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)

Reviewed commit: e845f9514aad91c4c558a400f89750481810db13

• CodeRabbit: rate limited — its 11:31Z reply on this PR was a rate-limit notice, and the 11:43Z rate-limit reply on this repository (lane-health read 12:07Z) names a reset near 12:25Z; no review artifact exists at this head.
• Codex: usage limit since 2026-10-19 22:44Z (lane-health read 12:07Z today); no Codex artifact on this PR.
• Cursor Bugbot: usage limit since 2026-10-19 22:18Z (lane-health read 12:07Z today); no Bugbot check-run on this PR.

Scope read: the whole diff against main, plus every caller of the transport proof (its workflow, the CI entry and the staging Go test).

Correctness: the restriction is unchanged — a Certificate or CertificateRequest naming the arc-openbao-ca ClusterIssuer is denied outside openbao; an unset issuerRef.kind still means a namespaced Issuer and is not restricted; Deny matches the old Enforce. The new fixtures cover both same-name namespaced cases. The proof now reads the ValidatingPolicy by its full resource name, requires the live spec to equal the source spec exactly and status.conditionStatus.ready == true, and keeps the churn check. Read-only check on production: the four ValidatingPolicies already deployed carry no server-added spec keys and all report conditionStatus.ready: true, so the exact-equality check holds. The removed proof cases test fields that a ValidatingPolicy does not have; the new negative cases (admission or background off, Audit, a matchCondition exclusion, failurePolicy: Ignore, an unknown field, not ready) cover its equivalents. The proof runs with the production admin kubeconfig, so reading the new kind needs no RBAC change.

Security: the issuance boundary is preserved exactly; no trust, execution or egress boundary changes.

Verdict: no P0/P1 findings

[devantler]

🤖 Generated by the Agentic Engineer

Readiness — head e845f9514aad91c4c558a400f89750481810db13

1. Programmatically tested: CI at this head is green (29 success, 9 skipped by path filters), including the transport-proof fixture test with its new ValidatingPolicy negative cases. No unresolved review threads; branch is CLEAN against main.
2. Reviewed green at this head: fallback self-review 5584821318 (CodeRabbit rate limited until about 12:25Z, Codex and Cursor Bugbot at their usage limits): local-review-verdict.sh returns GREEN self@e845f951. Its one nit is answered and resolved.
3. Tried as a user: applied the old ClusterPolicy (main) and this ValidatingPolicy over a read-only export of production's certificates and certificate requests (names and issuer references only), 24 objects: old 2 pass / 22 skip / 0 fail, new 24 pass / 0 fail. Nothing is newly denied. The 22 out-of-scope objects now get a current pass instead of skip. Read-only on production: the deployed ValidatingPolicies carry no server-added spec keys and report conditionStatus.ready: true, which is what the updated proof requires.

Promoting and queueing at this head. After merge: close #5126 by hand (this PR delivers it; the body may carry only one Fixes).