fix: housekeeping pre-Sprint 3 (Kyverno + ESO + schema)#43
Merged
Conversation
Resolves PR_41_REVIEW.md F4 (MEDIUM, pre-existing). The previous form was stacked NotEquals conditions with value: "<registry>/*" — per Kyverno Condition schema, NotEquals is a fixed-value comparison and the "*" was treated as a literal asterisk character. Every container image trivially mismatched the literal, every condition fired, and validate would have denied every Pod — masked only by validationFailureAction: Audit. Migrate to the canonical Kyverno multi-registry allowlist pattern: foreach over each container list (containers, initContainers, ephemeralContainers) with `pattern.image` using the `|` OR operator. Evidence (Context7 lookup against /websites/kyverno_io): - "Operators" table on the validate doc page documents `|` as the logical-OR pattern operator. - "Enforce trusted registry for Pod images" example on the same page uses foreach over container lists with `pattern.image: <glob>`. Note: an earlier draft used anyPattern with one entry per registry. Reconsidered — that shape forces all containers + initContainers in a pod to come from a single registry, which would deny mixed-registry pods (e.g. main from ghcr.io/PodYourLife + initContainer from public.ecr.aws/aws-cli — Sprint 2C C4 commit 0ec75cf). foreach + pipe-OR preserves C4's mixed-registry support while flipping the broken NotEquals semantics into a correct allowlist. This is REQUIRED before flipping validationFailureAction Audit -> Enforce in any environment. Audit mode is preserved here.
Resolves PR_41_REVIEW.md F6 (LOW). ESO 0.10.x ships external-secrets.io/v1 as GA, with v1beta1 still served for backward compatibility but flagged as legacy in upstream docs. Migrate both manifests in lockstep to maintain consistency: - kubernetes/manifests/secrets/grafana-admin-externalsecret.yaml - kubernetes/helm/ml-batch-job/templates/external-secret.yaml No spec field changes — v1 is a stable rename of v1beta1 with no breaking schema changes per ESO 0.10 release notes. Out-of-scope follow-up flagged: kubernetes/secrets/local/secret-store.yaml also pins external-secrets.io/v1beta1 but on a ClusterSecretStore (not an ExternalSecret); local-Kind dev-only file. Worth a Sprint 3 tidy to keep the API surface consistent.
Resolves PR_41_REVIEW.md schema finding (Topic G, MEDIUM follow-up). Today the chart schema marks awsSecretPath as optional. With imagePullSecret.enabled=true and an empty awsSecretPath, helm template renders an ExternalSecret with key: "" and ESO silently fails at sync time with an opaque "secret not found" error. Add a JSON Schema draft-07 conditional (if/then) at the imagePullSecret level: when enabled=true, awsSecretPath becomes required and must satisfy minLength: 1. Existing consumers (quanvnn-dev.yaml) already comply — they set awsSecretPath: "platform/ghcr-pull-token". No breaking change. Verified locally: - helm lint with quanvnn-dev.yaml passes (positive). - helm lint with enabled=true + awsSecretPath="" fails with "at '/imagePullSecret/awsSecretPath': minLength: got 0, want 1" (negative).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sprint 2.5A — three CRITICAL non-blocking findings from PR_41_REVIEW.md folded into a housekeeping pass before Sprint 3.
Commits
0a7fbcdfix(kyverno): migrate image-registry policy to foreachf17cf3efix(eso): migrate ExternalSecret manifests to v1ea06b7efeat(chart-schema): require awsSecretPath when ESO opt-inFindings addressed
NotEquals + value: "*"was semantically broken (literal-string comparison; every Pod denied, masked by Audit). Migrated to the canonical Kyverno multi-registry allowlist usingforeachovercontainers/initContainers/ephemeralContainerswithpattern.imageusing the|OR operator. REQUIRED before flippingAudit->Enforce. Preserves Sprint 2C C4 mixed-registry support (ghcr.io/PodYourLife/*main +public.ecr.aws/aws-cli/*initContainer).v1beta1->v1across bothExternalSecretmanifests in lockstep (Grafana baseline + ml-batch-job chart template). No spec field changes — v1 is a stable rename per ESO 0.10 release notes.if/thenat theimagePullSecretlevel — whenenabled: true,awsSecretPathbecomes required and must satisfyminLength: 1. Closes the silent-fail path where ESO would receivekey: "".Pattern choice deviation (announced & approved)
The prompt's literal
anyPatternshape was reconsidered after Context7 surfaced (a) the KyvernoOperatorstable documenting|as the logical-OR pattern operator, and (b) the canonical "Enforce trusted registry for Pod images" example usingforeach. TheanyPatternshape would have denied mixed-registry pods (Sprint 2C C4 regression). Theforeach+ pipe-OR form is both Kyverno-canonical and preserves C4 behavior.Out of scope (deferred)
failOnInitError: trueetc.)preemptionPolicyexplicit)kubernetes/secrets/local/secret-store.yamlstill onexternal-secrets.io/v1beta1— out of scope by kind (ClusterSecretStore, notExternalSecret) and lives in the local-Kind dev dir; flagged for a Sprint 3 tidyValidation
helm lint kubernetes/helm/ml-batch-job/ -f kubernetes/helm/values/quanvnn-dev.yaml→ passes (positive).helm template ... | grep -B1 'kind: ExternalSecret'→ rendersapiVersion: external-secrets.io/v1.helm lintwithenabled: true+awsSecretPath: ""→ fails withat '/imagePullSecret/awsSecretPath': minLength: got 0, want 1(negative).python3 -m json.toolon the schema.Test plan
foreachshape is acceptable vs. literal prompt'sanyPattern.v1is served on the running ESO 0.10.7 install (no consumer breakage).Reference