@raishin/vanguard-frontier-agentic 3.12.1 → 3.13.0

package/tests/integration/rbac-pre-flight/fixtures/crds.yaml

@@ -0,0 +1,565 @@
+# tests/integration/rbac-pre-flight/fixtures/crds.yaml
+#
+# Minimal stand-ins for the third-party CRDs the guards assert against.
+#
+# Why these are needed, and why stubs are enough
+# ----------------------------------------------
+# `kubectl auth can-i` resolves its resource argument through discovery before
+# posting the SelfSubjectAccessReview.  When the resource is absent,
+# resourceFor() warns and falls back to
+# `GroupVersionResource{Resource: <the whole dotted argument>}` with an EMPTY
+# group (kubernetes/kubernetes
+# staging/src/k8s.io/kubectl/pkg/cmd/auth/cani.go, identical at v1.28.15 and
+# v1.31.2).  The review therefore asks about {group: "", resource:
+# "schedules.velero.io"}, which no RBAC rule can match, and kubectl answers
+# "no" whatever the manifests actually grant.
+#
+# Measured against a live kube-apiserver v1.30.6 with RBAC, for a service
+# account explicitly granted velero.io/schedules create:
+#
+#   CRD absent   -> "no"   + "the server doesn't have a resource type
+#                            'schedules' in group 'velero.io'" on stderr
+#   CRD present  -> "yes"
+#
+# So the absent-CRD verdict is not merely unavailable, it is wrong in both
+# directions: every must-not check would pass vacuously and every must-be-able
+# check would fail spuriously.
+#
+# Discovery is all that is required -- nothing here is ever instantiated, and
+# no controller reconciles it.  Only `group`, `names.plural`, `names.kind` and
+# `scope` are load-bearing; the schema is deliberately open.  Shipping stubs
+# in-tree rather than fetching upstream bundles keeps the gate deterministic:
+# no network at test time, no version drift, and the same behaviour on every
+# Kubernetes version in the matrix.
+#
+# Built-in Kubernetes resources are NOT stubbed here -- a CRD cannot shadow a
+# built-in API group, and their absence really would mean a broken cluster.
+#
+# The group, plural, kind and scope of all 24 stubs were checked against the
+# upstream CRD manifests on each project's default branch (argo-cd, istio,
+# velero, cilium, kyverno, gateway-api) and match.
+#
+# The gateway.networking.k8s.io stubs carry `api-approved.kubernetes.io`.  Any
+# group under *.k8s.io is protected: apiextensions rejects a CRD in one without
+# that annotation, and rejects a value that is neither a URL nor a reason
+# starting with "unapproved" (measured on v1.30.6).  It never checks what a URL
+# points to.  Upstream carries a per-release review URL, but these stubs are
+# not that reviewed schema, so they declare themselves unapproved instead of
+# borrowing an approval.  The CRD still establishes; only its
+# KubernetesAPIApprovalPolicyConformant condition reads False, which nothing
+# here consults.
+#
+# Keep in sync with the `*_or_skip` assertions in guards/; every resource the
+# guards name with a group suffix needs an entry.
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: applications.argoproj.io
+spec:
+  group: argoproj.io
+  scope: Namespaced
+  names:
+    plural: applications
+    singular: application
+    kind: Application
+    listKind: ApplicationList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: applicationsets.argoproj.io
+spec:
+  group: argoproj.io
+  scope: Namespaced
+  names:
+    plural: applicationsets
+    singular: applicationset
+    kind: ApplicationSet
+    listKind: ApplicationSetList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: appprojects.argoproj.io
+spec:
+  group: argoproj.io
+  scope: Namespaced
+  names:
+    plural: appprojects
+    singular: appproject
+    kind: AppProject
+    listKind: AppProjectList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: authorizationpolicies.security.istio.io
+spec:
+  group: security.istio.io
+  scope: Namespaced
+  names:
+    plural: authorizationpolicies
+    singular: authorizationpolicy
+    kind: AuthorizationPolicy
+    listKind: AuthorizationPolicyList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: peerauthentications.security.istio.io
+spec:
+  group: security.istio.io
+  scope: Namespaced
+  names:
+    plural: peerauthentications
+    singular: peerauthentication
+    kind: PeerAuthentication
+    listKind: PeerAuthenticationList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: requestauthentications.security.istio.io
+spec:
+  group: security.istio.io
+  scope: Namespaced
+  names:
+    plural: requestauthentications
+    singular: requestauthentication
+    kind: RequestAuthentication
+    listKind: RequestAuthenticationList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: destinationrules.networking.istio.io
+spec:
+  group: networking.istio.io
+  scope: Namespaced
+  names:
+    plural: destinationrules
+    singular: destinationrule
+    kind: DestinationRule
+    listKind: DestinationRuleList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: gateways.networking.istio.io
+spec:
+  group: networking.istio.io
+  scope: Namespaced
+  names:
+    plural: gateways
+    singular: gateway
+    kind: Gateway
+    listKind: GatewayList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: virtualservices.networking.istio.io
+spec:
+  group: networking.istio.io
+  scope: Namespaced
+  names:
+    plural: virtualservices
+    singular: virtualservice
+    kind: VirtualService
+    listKind: VirtualServiceList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: backups.velero.io
+spec:
+  group: velero.io
+  scope: Namespaced
+  names:
+    plural: backups
+    singular: backup
+    kind: Backup
+    listKind: BackupList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: backupstoragelocations.velero.io
+spec:
+  group: velero.io
+  scope: Namespaced
+  names:
+    plural: backupstoragelocations
+    singular: backupstoragelocation
+    kind: BackupStorageLocation
+    listKind: BackupStorageLocationList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: restores.velero.io
+spec:
+  group: velero.io
+  scope: Namespaced
+  names:
+    plural: restores
+    singular: restore
+    kind: Restore
+    listKind: RestoreList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: schedules.velero.io
+spec:
+  group: velero.io
+  scope: Namespaced
+  names:
+    plural: schedules
+    singular: schedule
+    kind: Schedule
+    listKind: ScheduleList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: ciliumnetworkpolicies.cilium.io
+spec:
+  group: cilium.io
+  scope: Namespaced
+  names:
+    plural: ciliumnetworkpolicies
+    singular: ciliumnetworkpolicy
+    kind: CiliumNetworkPolicy
+    listKind: CiliumNetworkPolicyList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: ciliumendpoints.cilium.io
+spec:
+  group: cilium.io
+  scope: Namespaced
+  names:
+    plural: ciliumendpoints
+    singular: ciliumendpoint
+    kind: CiliumEndpoint
+    listKind: CiliumEndpointList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: ciliumclusterwidenetworkpolicies.cilium.io
+spec:
+  group: cilium.io
+  scope: Cluster
+  names:
+    plural: ciliumclusterwidenetworkpolicies
+    singular: ciliumclusterwidenetworkpolicy
+    kind: CiliumClusterwideNetworkPolicy
+    listKind: CiliumClusterwideNetworkPolicyList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: ciliumegressgatewaypolicies.cilium.io
+spec:
+  group: cilium.io
+  scope: Cluster
+  names:
+    plural: ciliumegressgatewaypolicies
+    singular: ciliumegressgatewaypolicy
+    kind: CiliumEgressGatewayPolicy
+    listKind: CiliumEgressGatewayPolicyList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: clusterpolicies.kyverno.io
+spec:
+  group: kyverno.io
+  scope: Cluster
+  names:
+    plural: clusterpolicies
+    singular: clusterpolicy
+    kind: ClusterPolicy
+    listKind: ClusterPolicyList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: policies.kyverno.io
+spec:
+  group: kyverno.io
+  scope: Namespaced
+  names:
+    plural: policies
+    singular: policy
+    kind: Policy
+    listKind: PolicyList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: policyexceptions.kyverno.io
+spec:
+  group: kyverno.io
+  scope: Namespaced
+  names:
+    plural: policyexceptions
+    singular: policyexception
+    kind: PolicyException
+    listKind: PolicyExceptionList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: gateways.gateway.networking.k8s.io
+  annotations:
+    api-approved.kubernetes.io: "unapproved, test stub for RBAC evaluation only"
+spec:
+  group: gateway.networking.k8s.io
+  scope: Namespaced
+  names:
+    plural: gateways
+    singular: gateway
+    kind: Gateway
+    listKind: GatewayList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: httproutes.gateway.networking.k8s.io
+  annotations:
+    api-approved.kubernetes.io: "unapproved, test stub for RBAC evaluation only"
+spec:
+  group: gateway.networking.k8s.io
+  scope: Namespaced
+  names:
+    plural: httproutes
+    singular: httproute
+    kind: HTTPRoute
+    listKind: HTTPRouteList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: grpcroutes.gateway.networking.k8s.io
+  annotations:
+    api-approved.kubernetes.io: "unapproved, test stub for RBAC evaluation only"
+spec:
+  group: gateway.networking.k8s.io
+  scope: Namespaced
+  names:
+    plural: grpcroutes
+    singular: grpcroute
+    kind: GRPCRoute
+    listKind: GRPCRouteList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: referencegrants.gateway.networking.k8s.io
+  annotations:
+    api-approved.kubernetes.io: "unapproved, test stub for RBAC evaluation only"
+spec:
+  group: gateway.networking.k8s.io
+  scope: Namespaced
+  names:
+    plural: referencegrants
+    singular: referencegrant
+    kind: ReferenceGrant
+    listKind: ReferenceGrantList
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true

package/tests/integration/rbac-pre-flight/guards/network-arch.sh

@@ -42,9 +42,9 @@ run_guard_network_arch() {
   assert_cannot delete nodes "--as=$SA"
   assert_cannot patch nodes "--as=$SA"
   assert_cannot update nodes "--as=$SA"
-  assert_cannot create pods/eviction "--as=$SA"
-  assert_cannot get nodes/proxy "--as=$SA"
-  assert_cannot create nodes/proxy "--as=$SA"
+  assert_cannot create pods --subresource=eviction "--as=$SA"
+  assert_cannot get nodes --subresource=proxy "--as=$SA"
+  assert_cannot create nodes --subresource=proxy "--as=$SA"
 
   # Lease objects
   assert_cannot patch leases.coordination.k8s.io -n kube-node-lease "--as=$SA"
@@ -59,8 +59,8 @@ run_guard_network_arch() {
   assert_cannot delete apiservices.apiregistration.k8s.io "--as=$SA"
 
   # Pod subresources
-  assert_cannot create pods/proxy --all-namespaces "--as=$SA"
-  assert_cannot create pods/binding --all-namespaces "--as=$SA"
+  assert_cannot create pods --subresource=proxy --all-namespaces "--as=$SA"
+  assert_cannot create pods --subresource=binding --all-namespaces "--as=$SA"
 
   # CSR / token minting
   assert_cannot create certificatesigningrequests.certificates.k8s.io "--as=$SA"
@@ -83,8 +83,9 @@ run_guard_network_arch() {
   assert_cannot patch ingressclasses.networking.k8s.io "--as=$SA"
   assert_cannot patch storageclasses.storage.k8s.io "--as=$SA"
 
-  # Finalizer-stripping paths
-  assert_cannot update customresourcedefinitions/finalize "--as=$SA"
+  # Finalizer-stripping paths.  A CRD has no `finalize` subresource (only
+  # `status`); stripping its finalizers is an update to the object itself.
+  assert_cannot update customresourcedefinitions "--as=$SA"
 
   # resourceName negative tests — same configmap name in wrong namespace
   assert_cannot patch configmaps/coredns -n default "--as=$SA"