@raishin/vanguard-frontier-agentic 3.12.0 → 3.13.0

package/tests/integration/rbac-pre-flight/lib/common.sh

@@ -26,10 +26,16 @@ fi
 GUARD_PASS=0
 GUARD_FAIL=0
 GUARD_SKIP=0
+# GUARD_ERROR counts checks that produced no verdict for a reason that is NOT
+# an expected property of the environment -- an unreachable API server, a
+# refused impersonation, a malformed flag.  Kept apart from GUARD_SKIP so a
+# broken harness is never filed as "this cluster simply lacks that CRD".
+GUARD_ERROR=0
 
 TOTAL_PASS=0
 TOTAL_FAIL=0
 TOTAL_SKIP=0
+TOTAL_ERROR=0
 
 # ---------------------------------------------------------------------------
 # require_kubectl — abort early if kubectl is not on PATH
@@ -45,20 +51,101 @@ require_kubectl() {
 # ---------------------------------------------------------------------------
 # _run_can_i — internal helper
 #   Usage: _run_can_i <verb> <resource> [extra kubectl flags...] --as=<SA>
-#   Returns the raw output of kubectl auth can-i (yes/no) in CANI_OUTPUT.
-#   Returns 0 on success, non-zero on kubectl error (distinct from denied).
+#
+#   Sets:
+#     CANI_OUTPUT  kubectl's stdout (the verdict: "yes" or "no...")
+#     CANI_STDERR  kubectl's stderr (warnings and errors)
+#     CANI_EXIT    kubectl's exit status
+#     CANI_REASON  when no verdict was obtained: 'unresolved' or 'error'
+#
+#   Returns 0 on a verdict, 2 when the resource could not be resolved against
+#   discovery, 3 on any other failure to obtain a verdict.
+#
+#   Why stdout and stderr are kept apart
+#   -----------------------------------
+#   `kubectl auth can-i` writes the verdict to stdout and every diagnostic to
+#   stderr.  Verified against kubernetes/kubernetes
+#   staging/src/k8s.io/kubectl/pkg/cmd/auth/cani.go, identical at v1.28.15 and
+#   v1.31.2 (both ends of this suite's CI matrix): the verdict goes to `o.Out`
+#   (RunAccessCheck), while the WarningPrinter is constructed over `o.ErrOut`
+#   (Complete) and carries "resource 'X' is not namespace scoped" and "the
+#   server doesn't have a resource type 'X'".
+#
+#   This helper used to capture `2>&1`.  A cluster-scoped resource therefore
+#   arrived as "Warning: resource 'clusterrolebindings' is not namespace scoped
+#   in group 'rbac.authorization.k8s.io'\nno", which matches neither yes* nor
+#   no*, so a perfectly good verdict was discarded as a kubectl error.  In CI
+#   that silently converted 176 of 294 assertions into skips.
 # ---------------------------------------------------------------------------
 _run_can_i() {
-  # kubectl auth can-i exits 0 for "yes" and 1 for "no".
-  # We capture output regardless of exit code.
-  CANI_OUTPUT=$(kubectl auth can-i "$@" 2>&1)
+  local stderr_file
+  stderr_file=$(mktemp "${TMPDIR:-/tmp}/cani-stderr.XXXXXX")
+
+  # kubectl auth can-i exits 0 for "yes" and 1 for "no"; both are verdicts.
+  CANI_OUTPUT=$(kubectl auth can-i "$@" 2>"$stderr_file")
   CANI_EXIT=$?
-  # Propagate real errors (not the normal denied exit) to the caller.
-  # kubectl prints "yes\n" or "no\n"; anything else is an error.
+  CANI_STDERR=$(cat "$stderr_file")
+  rm -f "$stderr_file"
+  CANI_REASON=""
+
+  # An unresolved resource is checked BEFORE the verdict, because kubectl
+  # still prints one and it is worthless.  resourceFor() warns and then
+  # returns schema.GroupVersionResource{Resource: resourceArg} -- the whole
+  # dotted argument as the resource name, with an EMPTY group.  The
+  # SelfSubjectAccessReview therefore asks about
+  # {group: "", resource: "schedules.velero.io"}, which no RBAC rule can ever
+  # match, so kubectl answers "no" whatever the manifests grant.
+  #
+  # Accepting that verdict would be a fail-open: every `assert_cannot_or_skip`
+  # on an uninstalled CRD would PASS vacuously, while every
+  # `assert_can_or_skip` would FAIL spuriously.  Treat it as no verdict.
+  case "$CANI_STDERR" in
+    *"doesn't have a resource type"*|*"server could not find the requested resource"*|*"no matches for kind"*)
+      CANI_REASON="unresolved"
+      return 2
+      ;;
+  esac
+
+  # "resource 'X' is not namespace scoped" is benign -- the GVR resolved, the
+  # verdict is real, and only the -n flag was redundant.  Do not let it
+  # suppress an answer.
   case "$CANI_OUTPUT" in
     yes*|no*) return 0 ;;
-    *) return 2 ;;   # unexpected output / server error
   esac
+
+  # No verdict and no recognised cause.  Report kubectl's own words rather
+  # than attributing it to the call site -- filing every failure as "CRD not
+  # found" is how a broken cluster passes for an expected limitation.
+  CANI_REASON="error"
+  return 3
+}
+
+# ---------------------------------------------------------------------------
+# _report_no_verdict — shared handling for a check that produced no verdict
+#   Usage: _report_no_verdict <rc> <"can"|"cannot"> <description> <tolerate_unresolved>
+#   Returns 0 if the caller should stop (it was counted), 1 to continue.
+# ---------------------------------------------------------------------------
+_report_no_verdict() {
+  local rc="$1" word="$2" description="$3" tolerate="$4"
+
+  [ "$rc" -eq 0 ] && return 1
+
+  if [ "$rc" -eq 2 ] && [ "$tolerate" = "true" ]; then
+    # Expected environment limitation: the resource is absent from discovery.
+    # Still a check that never ran, so it counts as a skip and keeps the run
+    # INCOMPLETE -- it is not evidence that the binding is correctly scoped.
+    printf '  %b[SKIP]%b %-6s %-60s  (not in discovery: %s)\n' \
+      "$_YELLOW" "$_RESET" "$word" "$description" "$CANI_STDERR"
+    (( GUARD_SKIP++ )) || true
+    return 0
+  fi
+
+  # Everything else is a harness or cluster problem.  Report kubectl's own
+  # words rather than a guess about the cause.
+  printf '  %b[ERROR]%b %-5s %-60s  (no verdict [%s]: %s)\n' \
+    "$_RED" "$_RESET" "$word" "$description" "${CANI_REASON:-unknown}" "$CANI_STDERR"
+  (( GUARD_ERROR++ )) || true
+  return 0
 }
 
 # ---------------------------------------------------------------------------
@@ -67,24 +154,24 @@ _run_can_i() {
 # ---------------------------------------------------------------------------
 assert_cannot() {
   local description="$*"
-  _run_can_i "$@"
-  local rc=$?
+  local rc=0
+  _run_can_i "$@" || rc=$?
 
-  if [ $rc -eq 2 ]; then
-    printf '  %b[SKIP]%b cannot %-60s  (kubectl error: %s)\n' \
-      "$_YELLOW" "$_RESET" "$description" "$CANI_OUTPUT"
-    (( GUARD_SKIP++ )) || true
-    return
-  fi
+  # Core Kubernetes resources: absence from discovery is a broken cluster,
+  # not an expected limitation, so it is never tolerated here.
+  _report_no_verdict "$rc" cannot "$description" false && return
 
-  if [ "$CANI_OUTPUT" = "no" ]; then
-    printf '  %b[PASS]%b cannot %s\n' "$_GREEN" "$_RESET" "$description"
-    (( GUARD_PASS++ )) || true
-  else
-    printf '  %b[FAIL]%b cannot %-60s  (got: %s — binding is over-scoped)\n' \
-      "$_RED" "$_RESET" "$description" "$CANI_OUTPUT"
-    (( GUARD_FAIL++ )) || true
-  fi
+  case "$CANI_OUTPUT" in
+    no*)
+      printf '  %b[PASS]%b cannot %s\n' "$_GREEN" "$_RESET" "$description"
+      (( GUARD_PASS++ )) || true
+      ;;
+    *)
+      printf '  %b[FAIL]%b cannot %-60s  (got: %s — binding is over-scoped)\n' \
+        "$_RED" "$_RESET" "$description" "$CANI_OUTPUT"
+      (( GUARD_FAIL++ )) || true
+      ;;
+  esac
 }
 
 # ---------------------------------------------------------------------------
@@ -93,78 +180,75 @@ assert_cannot() {
 # ---------------------------------------------------------------------------
 assert_can() {
   local description="$*"
-  _run_can_i "$@"
-  local rc=$?
+  local rc=0
+  _run_can_i "$@" || rc=$?
 
-  if [ $rc -eq 2 ]; then
-    printf '  %b[SKIP]%b can    %-60s  (kubectl error: %s)\n' \
-      "$_YELLOW" "$_RESET" "$description" "$CANI_OUTPUT"
-    (( GUARD_SKIP++ )) || true
-    return
-  fi
+  _report_no_verdict "$rc" can "$description" false && return
 
-  if [ "$CANI_OUTPUT" = "yes" ]; then
-    printf '  %b[PASS]%b can    %s\n' "$_GREEN" "$_RESET" "$description"
-    (( GUARD_PASS++ )) || true
-  else
-    printf '  %b[FAIL]%b can    %-60s  (got: %s — binding is under-scoped)\n' \
-      "$_RED" "$_RESET" "$description" "$CANI_OUTPUT"
-    (( GUARD_FAIL++ )) || true
-  fi
+  case "$CANI_OUTPUT" in
+    yes*)
+      printf '  %b[PASS]%b can    %s\n' "$_GREEN" "$_RESET" "$description"
+      (( GUARD_PASS++ )) || true
+      ;;
+    *)
+      printf '  %b[FAIL]%b can    %-60s  (got: %s — binding is under-scoped)\n' \
+        "$_RED" "$_RESET" "$description" "$CANI_OUTPUT"
+      (( GUARD_FAIL++ )) || true
+      ;;
+  esac
 }
 
 # ---------------------------------------------------------------------------
-# assert_can_or_skip — like assert_can but treats "NotFound" CRD errors as SKIP
-#   Use for Gateway API / Cilium / Istio / Argo CD / Velero / Kyverno CRDs that
-#   may not exist in a vanilla kind cluster.
+# assert_can_or_skip — like assert_can but tolerates a resource that is absent
+#   from discovery (Gateway API / Cilium / Istio / Argo CD / Velero / Kyverno
+#   CRDs that a vanilla kind cluster does not install).
+#
+#   Tolerated means SKIP, not PASS: the run stays INCOMPLETE.  When the CRDs
+#   ARE installed the check runs for real, which is why the suite ships
+#   fixtures/crds.yaml.
 # ---------------------------------------------------------------------------
 assert_can_or_skip() {
   local description="$*"
-  _run_can_i "$@"
-  local rc=$?
+  local rc=0
+  _run_can_i "$@" || rc=$?
 
-  if [ $rc -eq 2 ]; then
-    # CRD not installed — skip rather than fail
-    printf '  %b[SKIP]%b can    %-60s  (CRD not found — install CRDs to test)\n' \
-      "$_YELLOW" "$_RESET" "$description"
-    (( GUARD_SKIP++ )) || true
-    return
-  fi
+  _report_no_verdict "$rc" can "$description" true && return
 
-  if [ "$CANI_OUTPUT" = "yes" ]; then
-    printf '  %b[PASS]%b can    %s\n' "$_GREEN" "$_RESET" "$description"
-    (( GUARD_PASS++ )) || true
-  else
-    printf '  %b[FAIL]%b can    %-60s  (got: %s — binding is under-scoped)\n' \
-      "$_RED" "$_RESET" "$description" "$CANI_OUTPUT"
-    (( GUARD_FAIL++ )) || true
-  fi
+  case "$CANI_OUTPUT" in
+    yes*)
+      printf '  %b[PASS]%b can    %s\n' "$_GREEN" "$_RESET" "$description"
+      (( GUARD_PASS++ )) || true
+      ;;
+    *)
+      printf '  %b[FAIL]%b can    %-60s  (got: %s — binding is under-scoped)\n' \
+        "$_RED" "$_RESET" "$description" "$CANI_OUTPUT"
+      (( GUARD_FAIL++ )) || true
+      ;;
+  esac
 }
 
 # ---------------------------------------------------------------------------
-# assert_cannot_or_skip — like assert_cannot but treats "NotFound" as SKIP
-#   Use for domain-specific must-not checks on CRDs that may not be installed.
+# assert_cannot_or_skip — like assert_cannot but tolerates a resource that is
+#   absent from discovery.  See assert_can_or_skip.
 # ---------------------------------------------------------------------------
 assert_cannot_or_skip() {
   local description="$*"
-  _run_can_i "$@"
-  local rc=$?
+  local rc=0
+  _run_can_i "$@" || rc=$?
 
-  if [ $rc -eq 2 ]; then
-    printf '  %b[SKIP]%b cannot %-60s  (CRD not found — install CRDs to test)\n' \
-      "$_YELLOW" "$_RESET" "$description"
-    (( GUARD_SKIP++ )) || true
-    return
-  fi
+  _report_no_verdict "$rc" cannot "$description" true && return
 
-  if [ "$CANI_OUTPUT" = "no" ]; then
-    printf '  %b[PASS]%b cannot %s\n' "$_GREEN" "$_RESET" "$description"
-    (( GUARD_PASS++ )) || true
-  else
-    printf '  %b[FAIL]%b cannot %-60s  (got: %s — binding is over-scoped)\n' \
-      "$_RED" "$_RESET" "$description" "$CANI_OUTPUT"
-    (( GUARD_FAIL++ )) || true
-  fi
+  case "$CANI_OUTPUT" in
+    no*)
+      printf '  %b[PASS]%b cannot %s\n' "$_GREEN" "$_RESET" "$description"
+      (( GUARD_PASS++ )) || true
+      ;;
+    *)
+      printf '  %b[FAIL]%b cannot %-60s  (got: %s — binding is over-scoped)\n' \
+        "$_RED" "$_RESET" "$description" "$CANI_OUTPUT"
+      (( GUARD_FAIL++ )) || true
+      ;;
+  esac
 }
 
 # ---------------------------------------------------------------------------
@@ -178,8 +262,8 @@ run_universal_must_not() {
   assert_cannot '*' '*' --all-namespaces "--as=$SA"
   assert_cannot delete namespaces "--as=$SA"
   assert_cannot delete pods -n kube-system "--as=$SA"
-  assert_cannot create pods/exec -n kube-system "--as=$SA"
-  assert_cannot create pods/portforward --all-namespaces "--as=$SA"
+  assert_cannot create pods --subresource=exec -n kube-system "--as=$SA"
+  assert_cannot create pods --subresource=portforward --all-namespaces "--as=$SA"
   assert_cannot delete daemonsets -n kube-system "--as=$SA"
   assert_cannot delete deployments -n kube-system "--as=$SA"
   assert_cannot create customresourcedefinitions "--as=$SA"
@@ -191,11 +275,11 @@ run_universal_must_not() {
   assert_cannot create validatingwebhookconfigurations.admissionregistration.k8s.io "--as=$SA"
   assert_cannot create apiservices.apiregistration.k8s.io "--as=$SA"
   assert_cannot update certificatesigningrequests.certificates.k8s.io --subresource=approval "--as=$SA"
-  assert_cannot create serviceaccounts/token --all-namespaces "--as=$SA"
+  assert_cannot create serviceaccounts --subresource=token --all-namespaces "--as=$SA"
   assert_cannot delete priorityclasses.scheduling.k8s.io "--as=$SA"
   assert_cannot delete ingressclasses.networking.k8s.io "--as=$SA"
   assert_cannot delete leases.coordination.k8s.io -n kube-node-lease "--as=$SA"
-  assert_cannot update namespaces/finalize "--as=$SA"
+  assert_cannot update namespaces --subresource=finalize "--as=$SA"
 }
 
 # ---------------------------------------------------------------------------
@@ -206,6 +290,7 @@ begin_guard() {
   GUARD_PASS=0
   GUARD_FAIL=0
   GUARD_SKIP=0
+  GUARD_ERROR=0
   printf '\n%b=== Guard: %s ===%b\n' "$_CYAN" "$guard_name" "$_RESET"
 }
 
@@ -218,21 +303,43 @@ report_guard() {
   local status_color="$_GREEN"
   local status_word="PASS"
 
+  # A skipped check is an assertion that was never made.  This harness is the
+  # privilege-creep regression gate for the least-privilege RBAC manifests that
+  # ship with the Kubernetes live-guard agents, so "could not check" must never
+  # render as "PASS" — an unreachable cluster or a failing impersonation would
+  # otherwise report a clean bill of health over zero executed checks.
+  if [ "$GUARD_SKIP" -gt 0 ] || [ "$GUARD_PASS" -eq 0 ]; then
+    status_color="$_YELLOW"
+    status_word="INCOMPLETE"
+  fi
+
+  # A harness or cluster problem outranks an incomplete run: an expected
+  # environment limitation is survivable, a broken check is not.
+  if [ "$GUARD_ERROR" -gt 0 ]; then
+    status_color="$_RED"
+    status_word="ERROR"
+  fi
+
+  # A real failure outranks everything: it is the only outcome that says
+  # something about the manifests themselves.
   if [ "$GUARD_FAIL" -gt 0 ]; then
     status_color="$_RED"
     status_word="FAIL"
   fi
 
-  printf '%b  %s: %d passed, %d failed, %d skipped%b\n' \
+  printf '%b  %s: %d passed, %d failed, %d skipped, %d errored%b\n' \
     "$status_color" "$status_word" \
-    "$GUARD_PASS" "$GUARD_FAIL" "$GUARD_SKIP" \
+    "$GUARD_PASS" "$GUARD_FAIL" "$GUARD_SKIP" "$GUARD_ERROR" \
     "$_RESET"
 
   (( TOTAL_PASS += GUARD_PASS )) || true
   (( TOTAL_FAIL += GUARD_FAIL )) || true
   (( TOTAL_SKIP += GUARD_SKIP )) || true
+  (( TOTAL_ERROR += GUARD_ERROR )) || true
 
-  [ "$GUARD_FAIL" -eq 0 ]  # returns 1 when there are failures
+  # Non-zero unless every check in this guard actually ran and passed.
+  [ "$GUARD_FAIL" -eq 0 ] && [ "$GUARD_SKIP" -eq 0 ] && [ "$GUARD_ERROR" -eq 0 ] \
+    && [ "$GUARD_PASS" -gt 0 ]
 }
 
 # ---------------------------------------------------------------------------
@@ -240,13 +347,39 @@ report_guard() {
 # ---------------------------------------------------------------------------
 report_total() {
   printf '\n%b========================================%b\n' "$_CYAN" "$_RESET"
-  if [ "$TOTAL_FAIL" -eq 0 ]; then
-    printf '%bALL GUARDS PASSED%b  (%d passed, %d skipped)\n' \
-      "$_GREEN" "$_RESET" "$TOTAL_PASS" "$TOTAL_SKIP"
-  else
-    printf '%bFAILURES DETECTED%b  (%d passed, %d failed, %d skipped)\n' \
-      "$_RED" "$_RESET" "$TOTAL_PASS" "$TOTAL_FAIL" "$TOTAL_SKIP"
+  if [ "$TOTAL_FAIL" -gt 0 ]; then
+    printf '%bFAILURES DETECTED%b  (%d passed, %d failed, %d skipped, %d errored)\n' \
+      "$_RED" "$_RESET" "$TOTAL_PASS" "$TOTAL_FAIL" "$TOTAL_SKIP" "$TOTAL_ERROR"
+    printf '%b========================================%b\n' "$_CYAN" "$_RESET"
+    return 1
   fi
+
+  # Exit 3 == ERROR: checks failed to produce a verdict for a reason that is
+  # not a property of this environment.  Distinct from INCOMPLETE so a broken
+  # cluster is never read as "those CRDs just are not installed here".
+  if [ "$TOTAL_ERROR" -gt 0 ]; then
+    printf '%bHARNESS ERRORS%b  (%d passed, %d failed, %d skipped, %d errored)\n' \
+      "$_RED" "$_RESET" "$TOTAL_PASS" "$TOTAL_FAIL" "$TOTAL_SKIP" "$TOTAL_ERROR"
+    printf '  %d check(s) could not obtain a verdict from kubectl.  Each line above\n' "$TOTAL_ERROR"
+    printf '  carries kubectl'"'"'s own stderr; this is a harness or cluster fault, not\n'
+    printf '  a statement about the RBAC manifests.\n'
+    printf '%b========================================%b\n' "$_CYAN" "$_RESET"
+    return 3
+  fi
+
+  # Exit 2 == INCOMPLETE: distinct from both PASS and FAIL so a caller can tell
+  # "the manifests are clean" from "the checks never ran".
+  if [ "$TOTAL_SKIP" -gt 0 ] || [ "$TOTAL_PASS" -eq 0 ]; then
+    printf '%bINCOMPLETE%b  (%d passed, %d failed, %d skipped, %d errored)\n' \
+      "$_YELLOW" "$_RESET" "$TOTAL_PASS" "$TOTAL_FAIL" "$TOTAL_SKIP" "$TOTAL_ERROR"
+    printf '  %d check(s) did not execute; this run proves nothing about\n' "$TOTAL_SKIP"
+    printf '  privilege creep in the shipped RBAC manifests.\n'
+    printf '%b========================================%b\n' "$_CYAN" "$_RESET"
+    return 2
+  fi
+
+  printf '%bALL GUARDS PASSED%b  (%d passed, %d skipped, %d errored)\n' \
+    "$_GREEN" "$_RESET" "$TOTAL_PASS" "$TOTAL_SKIP" "$TOTAL_ERROR"
   printf '%b========================================%b\n' "$_CYAN" "$_RESET"
-  [ "$TOTAL_FAIL" -eq 0 ]
+  return 0
 }

package/tests/integration/rbac-pre-flight/run-all.sh

@@ -15,8 +15,10 @@
 #   KIND_K8S_VERSION   kind node image tag (default: v1.30.6)
 #
 # Exit codes:
-#   0  all guards passed (skips do not count as failures)
-#   1  one or more assertions failed
+#   0  every check ran and passed
+#   1  one or more assertions failed (a manifest is over- or under-scoped)
+#   2  INCOMPLETE — some checks never ran, so nothing was proven
+#   3  HARNESS ERRORS — checks could not obtain a verdict from kubectl
 
 set -euo pipefail
 
@@ -78,14 +80,47 @@ create_cluster() {
   printf '%bCreating kind cluster %s (%s)...%b\n' \
     "$_CYAN" "$CLUSTER_NAME" "$KIND_IMAGE" "$_RESET"
 
+  # ValidatingAdmissionPolicy went GA in Kubernetes 1.30.  On 1.28 and 1.29 it
+  # is beta and, per the post-1.24 policy for beta APIs, both the feature gate
+  # and the API group are OFF by default -- so `validatingadmissionpolicies` is
+  # simply absent from discovery and the admission-policy guard cannot assert
+  # anything about it.
+  #
+  # Measured, not assumed.  Against a stock kube-apiserver with RBAC,
+  # /apis/admissionregistration.k8s.io/v1beta1 lists:
+  #
+  #   v1.28.15 default                     -> (nothing)
+  #   v1.28.15 + gate + runtime-config     -> validatingadmissionpolicies, ...
+  #   v1.29.10 default                     -> (nothing)
+  #   v1.29.10 + gate + runtime-config     -> validatingadmissionpolicies, ...
+  #
+  # Turning them on keeps all four matrix legs asserting the same thing.  The
+  # patch is scoped to those two versions: from 1.30 the gate is GA-locked and
+  # passing it earns a deprecation warning, and eventually a fatal error.
+  local extra_patches=""
+  case "${KIND_K8S_VERSION:-v1.30.6}" in
+    v1.28.*|v1.29.*)
+      extra_patches='
+kubeadmConfigPatches:
+  - |
+    kind: ClusterConfiguration
+    apiServer:
+      extraArgs:
+        feature-gates: "ValidatingAdmissionPolicy=true"
+        runtime-config: "admissionregistration.k8s.io/v1beta1=true"'
+      printf '%b(enabling beta ValidatingAdmissionPolicy for %s)%b\n' \
+        "$_YELLOW" "${KIND_K8S_VERSION}" "$_RESET"
+      ;;
+  esac
+
   kind create cluster \
     --name "$CLUSTER_NAME" \
     --image "$KIND_IMAGE" \
-    --config - <<'EOF'
+    --config - <<EOF
 kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 nodes:
-  - role: control-plane
+  - role: control-plane${extra_patches}
 EOF
 
   printf '%bCluster ready.%b\n' "$_GREEN" "$_RESET"
@@ -116,12 +151,30 @@ trap cleanup EXIT
 # ---------------------------------------------------------------------------
 # Apply RBAC manifests
 # ---------------------------------------------------------------------------
+apply_crd_stubs() {
+  printf '\n%bInstalling stub CRDs...%b\n' "$_CYAN" "$_RESET"
+
+  # `kubectl auth can-i` resolves its resource argument through discovery
+  # first.  Without these, it asks the API server about {group: "", resource:
+  # "schedules.velero.io"} and answers "no" regardless of what the manifests
+  # grant -- measured against kube-apiserver v1.30.6.  See fixtures/crds.yaml.
+  kubectl apply -f "$SCRIPT_DIR/fixtures/crds.yaml"
+
+  # Discovery is cached and refreshed asynchronously; give the aggregated
+  # discovery document a chance to pick the new groups up before asserting.
+  kubectl wait --for=condition=Established --timeout=60s \
+    -f "$SCRIPT_DIR/fixtures/crds.yaml"
+
+  printf '%bStub CRDs established.%b\n' "$_GREEN" "$_RESET"
+}
+
 apply_rbac_manifests() {
   printf '\n%bApplying RBAC manifests...%b\n' "$_CYAN" "$_RESET"
 
-  # Ensure the vanguard-system namespace exists
-  kubectl create namespace vanguard-system --dry-run=client -o yaml \
-    | kubectl apply -f -
+  # Ensure the namespaces the guards impersonate into exist.
+  for ns in vanguard-system velero argocd istio-system kyverno; do
+    kubectl create namespace "$ns" --dry-run=client -o yaml | kubectl apply -f -
+  done
 
   local manifests=(
     "skills/kubernetes/kubernetes-live-network-architecture-mutation-guard/references/least-privilege-rbac.yaml"
@@ -217,13 +270,14 @@ run_guards() {
       "$_YELLOW" "$_RESET"
   fi
 
+  apply_crd_stubs
   apply_rbac_manifests
   run_guards
 
-  # report_total exits 1 if any failures
-  if report_total; then
-    exit 0
-  else
-    exit 1
-  fi
+  # Propagate report_total's verdict verbatim so callers can distinguish the
+  # three states: 0 = every check ran and passed, 1 = real failures,
+  # 2 = INCOMPLETE (checks were skipped, so nothing was proven).
+  rc=0
+  report_total || rc=$?
+  exit "$rc"
 } 2>&1 | tee "$LOG_FILE"