Skip to content

fix(ci): pin the kind node image in the Kyverno admission smoke #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DuqueOM merged 1 commit into from
Sep 4, 2026
Merged

fix(ci): pin the kind node image in the Kyverno admission smoke #85

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,22 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Sem
38 cases pinning token classification, frozen-record exclusion,
dual-perspective resolution and all three baseline failure modes.
- Rationale and the full contract: `docs/governance/doc-path-references.md`.
### Fixed — the Kyverno admission smoke tested whatever Kubernetes version kind happened to bundle

- `scripts/test_kyverno_admission.sh` called `kind create cluster` with no
`--image`, so the Kubernetes version the shipped ClusterPolicies were
proven against was whatever the kind binary bundled at that moment.
That version moves with every `helm/kind-action` bump, which means a
routine dependency PR could silently change the platform the admission
contract is validated on — and the smoke would still report green.
- Surfaced while reviewing #81 (`kind-action` 1.14.0 → 1.15.0), whose
release notes carry `chore: bump default kind and kubectl`. The
golden-path workflows were unaffected because they pass an explicit
`node_image`; this script was the one place that did not.
- Pinned to `kindest/node:v1.30.0` via `KIND_NODE_IMAGE`, the same image
`KIND_IMAGE` pins in `golden-path.yml` and `golden-path-extended.yml`,
so admission and end-to-end now test one platform. Overridable by
environment variable, matching the existing `KYVERNO_VERSION` idiom.

### Fixed — ADR-026 branch protection was documented but never deployed

Expand Down
9 changes: 8 additions & 1 deletion scripts/test_kyverno_admission.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,13 @@ POLICY_FILE="${REPO_ROOT}/templates/k8s/policies/kyverno-image-verification.yaml
CLUSTER_NAME="kyverno-smoke"
TEST_NS="test-prod"
KYVERNO_VERSION="${KYVERNO_VERSION:-3.2.6}"
# Pin the node image. `kind create cluster` with no --image uses whatever
# Kubernetes version the kind binary bundles, which moves every time
# helm/kind-action is bumped — so the version these admission policies
# are proven against would drift silently with a dependency PR. The
# golden-path workflows already pin this exact image via KIND_IMAGE;
# keep the two in step so admission and end-to-end test one platform.
KIND_NODE_IMAGE="${KIND_NODE_IMAGE:-kindest/node:v1.30.0}"

log() { printf '==> %s\n' "$*" >&2; }
fail() { printf 'FAIL: %s\n' "$*" >&2; exit 1; }
Expand All @@ -51,7 +58,7 @@ command -v helm >/dev/null 2>&1 || fail "helm not installed"
[[ -f "${POLICY_FILE}" ]] || fail "policy file not found: ${POLICY_FILE}"

log "creating kind cluster: ${CLUSTER_NAME}"
kind create cluster --name "${CLUSTER_NAME}" --wait 120s
kind create cluster --name "${CLUSTER_NAME}" --image "${KIND_NODE_IMAGE}" --wait 120s

log "installing Kyverno ${KYVERNO_VERSION}"
helm repo add kyverno https://kyverno.github.io/kyverno/ >/dev/null
Expand Down
Loading