From 24cd37d6fec7e57387d2e641f479012980eee877 Mon Sep 17 00:00:00 2001 From: DuqueOM Date: Fri, 4 Sep 2026 11:18:09 -0600 Subject: [PATCH] fix(ci): pin the kind node image in the Kyverno admission smoke MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit scripts/test_kyverno_admission.sh called `kind create cluster` with no --image, so the Kubernetes version the shipped ClusterPolicies were proven against was whatever the kind binary happened to bundle. That version moves with every helm/kind-action bump, which means a routine dependency PR could silently change the platform the admission contract is validated on, and the smoke would still report green. Surfaced while reviewing #81 (kind-action 1.14.0 -> 1.15.0), whose release notes carry `chore: bump default kind and kubectl`. golden-path.yml and golden-path-extended.yml were unaffected because they pass an explicit node_image; this script was the one place that did not. Pinned to kindest/node:v1.30.0 via KIND_NODE_IMAGE — the same image KIND_IMAGE pins in both golden-path workflows, so admission and end-to-end now exercise one platform. Overridable by environment variable, matching the existing KYVERNO_VERSION idiom in the same file. Co-Authored-By: Claude Opus 5 --- CHANGELOG.md | 16 ++++++++++++++++ scripts/test_kyverno_admission.sh | 9 ++++++++- 2 files changed, 24 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7f34cf9..2765791 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -72,6 +72,22 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Sem 38 cases pinning token classification, frozen-record exclusion, dual-perspective resolution and all three baseline failure modes. - Rationale and the full contract: `docs/governance/doc-path-references.md`. +### Fixed — the Kyverno admission smoke tested whatever Kubernetes version kind happened to bundle + +- `scripts/test_kyverno_admission.sh` called `kind create cluster` with no + `--image`, so the Kubernetes version the shipped ClusterPolicies were + proven against was whatever the kind binary bundled at that moment. + That version moves with every `helm/kind-action` bump, which means a + routine dependency PR could silently change the platform the admission + contract is validated on — and the smoke would still report green. +- Surfaced while reviewing #81 (`kind-action` 1.14.0 → 1.15.0), whose + release notes carry `chore: bump default kind and kubectl`. The + golden-path workflows were unaffected because they pass an explicit + `node_image`; this script was the one place that did not. +- Pinned to `kindest/node:v1.30.0` via `KIND_NODE_IMAGE`, the same image + `KIND_IMAGE` pins in `golden-path.yml` and `golden-path-extended.yml`, + so admission and end-to-end now test one platform. Overridable by + environment variable, matching the existing `KYVERNO_VERSION` idiom. ### Fixed — ADR-026 branch protection was documented but never deployed diff --git a/scripts/test_kyverno_admission.sh b/scripts/test_kyverno_admission.sh index 5be374b..19f2781 100755 --- a/scripts/test_kyverno_admission.sh +++ b/scripts/test_kyverno_admission.sh @@ -34,6 +34,13 @@ POLICY_FILE="${REPO_ROOT}/templates/k8s/policies/kyverno-image-verification.yaml CLUSTER_NAME="kyverno-smoke" TEST_NS="test-prod" KYVERNO_VERSION="${KYVERNO_VERSION:-3.2.6}" +# Pin the node image. `kind create cluster` with no --image uses whatever +# Kubernetes version the kind binary bundles, which moves every time +# helm/kind-action is bumped — so the version these admission policies +# are proven against would drift silently with a dependency PR. The +# golden-path workflows already pin this exact image via KIND_IMAGE; +# keep the two in step so admission and end-to-end test one platform. +KIND_NODE_IMAGE="${KIND_NODE_IMAGE:-kindest/node:v1.30.0}" log() { printf '==> %s\n' "$*" >&2; } fail() { printf 'FAIL: %s\n' "$*" >&2; exit 1; } @@ -51,7 +58,7 @@ command -v helm >/dev/null 2>&1 || fail "helm not installed" [[ -f "${POLICY_FILE}" ]] || fail "policy file not found: ${POLICY_FILE}" log "creating kind cluster: ${CLUSTER_NAME}" -kind create cluster --name "${CLUSTER_NAME}" --wait 120s +kind create cluster --name "${CLUSTER_NAME}" --image "${KIND_NODE_IMAGE}" --wait 120s log "installing Kyverno ${KYVERNO_VERSION}" helm repo add kyverno https://kyverno.github.io/kyverno/ >/dev/null