fix(ci): pin the kind node image in the Kyverno admission smoke

[DuqueOM]

Closes the second of the two points.

The defect

scripts/test_kyverno_admission.sh:54 called:

kind create cluster --name "${CLUSTER_NAME}" --wait 120s

No --image. So the Kubernetes version the shipped ClusterPolicies are proven against was whatever the kind binary happened to bundle at that moment — and that version moves with every helm/kind-action bump.

The consequence is specific: a routine dependency PR can change the platform the admission contract is validated on, and the smoke still reports green. The script is careful about everything else — KYVERNO_VERSION is pinned and overridable, the policy file path is asserted, the cluster is torn down on trap — which makes the one unpinned input easy to miss.

How it surfaced

While reviewing #81 (helm/kind-action 1.14.0 → 1.15.0). Its release notes carry chore: bump default kind and kubectl — a change to the action's default node image.

golden-path.yml and golden-path-extended.yml were unaffected: both pass node_image: ${{ env.KIND_IMAGE }}, pinned to kindest/node:v1.30.0. kyverno-smoke.yml calls the action with install_only: true, so it never asks the action for a cluster at all — it just installs the binary and hands off to this script, which is where the unpinned kind create cluster lives. That is why the gap survived: the pin was present in the two places people look, and absent in the one place that actually creates the cluster the policies are tested on.

The fix

KIND_NODE_IMAGE="${KIND_NODE_IMAGE:-kindest/node:v1.30.0}"
...
kind create cluster --name "${CLUSTER_NAME}" --image "${KIND_NODE_IMAGE}" --wait 120s

Same image the golden-path workflows pin, so admission and end-to-end now exercise one platform rather than two that drift apart. Overridable by environment variable, matching the KYVERNO_VERSION idiom already in the file, so testing a policy against a newer Kubernetes stays a one-line override rather than an edit.

Verification

kyverno-smoke.yml filters on paths: and lists scripts/test_kyverno_admission.sh, so this PR triggers the smoke it changes — the admission test runs end to end against the newly pinned image rather than merging untested.

🤖 Generated with Claude Code