Skip to content

Commit 93f3273

Browse files
antoinetoussaint-byteclaude
antoinetoussaint-byte
and
claude
authored
build(deps): core v0.19.4, sdk-go/workcontext v0.1.0, kustomize v0.21.1 (#980) (#981)
* build(deps): core v0.19.4, sdk-go/workcontext v0.1.0, kustomize v0.21.1 (#980) Core v0.19.4 is additive over v0.19.2 (the issuer's non-consuming Authority.ReadBack) and holds kustomize at v0.21.1: v0.21.3's kube-openapi requires structured-merge-diff/v7, which breaks every build compiling client-go. go.mod LISTED kustomize v0.21.3 and kube-openapi 97fa35140926, and Go never lowers a listed version, so both are lowered explicitly here; `go mod graph | grep structured-merge-diff/v7` is now empty. sdk-go/workcontext moves from its pseudo-version to its first tag, v0.1.0, which unexports the Verifier alias behind NewVerifier/PinnedVerifier. The CLI never named it. The matrix declares the v0.19.4 line; supported-matrix.md and execution-receipts.md stop stating the old pins (the latter also stops citing TestNoSecondWorkContextImplementation, which no longer exists). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(gitops): admission policies stay cluster-scoped under kyaml v0.21.1 (#980) kyaml v0.21.1 does not know ValidatingAdmissionPolicy or ValidatingAdmissionPolicyBinding (v0.21.3 added both as cluster-scoped). With no answer, kustomize's namespace transformer stamps the overlay's namespace on them and knownClusterScoped reads them as namespaced, so: - validateManifest stopped requiring the AppProject's cluster authority for an admission policy, and snapshotAuthority derived namespaced authority for it; - validateObjectIdentities no longer indexed them globally, so two destinations shipping one cluster-wide policy each passed (TestPromotedTreeRefusesNamespaceFreeObjectsAcrossDestinations went red). knownClusterScoped falls back to a two-entry table only where kyaml has no answer, and TestKyamlStillForgetsTheAdmissionPolicyScopes fails once it has one, so the table is deleted with the next kustomize move. A known cluster-scoped object is indexed globally whatever namespace a transformer stamped on it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
1 parent 945189a commit 93f3273

8 files changed

Lines changed: 97 additions & 29 deletions

File tree

‎docs/execution-receipts.md‎

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -20,18 +20,17 @@ side** of the capability and the owner of its **carriers** — the HTTP header
2020
and the gRPC metadata the capability travels in, with the sealed installation
2121
beside it as a pre-check (`x-codefly-work-context`,
2222
`x-codefly-installation-id`, `x-codefly-installation-revision`, and the
23-
operation id). It mints nothing and verifies nothing: what it exports as a
24-
verification entry point is core's, by alias, and it deliberately does not
25-
re-export core's verify-only `Authenticator` (a client holds no issuer
26-
sources). The gateway reads the carrier through
23+
operation id). It mints nothing and has no check of its own: its one
24+
verification entry point, `NewVerifier` → `*PinnedVerifier`, wraps core's
25+
`Verifier` (kept unexported, so an unpinned one cannot be built), and it
26+
deliberately does not re-export core's verify-only `Authenticator` (a client
27+
holds no issuer sources). The gateway reads the carrier through
2728
`sdk-go/workcontext/grpctransport` and verifies through core — one carrier,
28-
one verifier, each in the repository that owns it. The leaf has no tag by
29-
design; it is pinned by commit, and only from the commit where its own
30-
earlier second implementation (a hand-written JSON payload signed beside
29+
one verifier, each in the repository that owns it. The leaf is pinned at its
30+
first release tag, `workcontext/v0.1.0`, which is past the commit where its
31+
own earlier second implementation (a hand-written JSON payload signed beside
3132
core's proto encoding, what core's `ErrNotACoreToken` exists to name) was
32-
deleted. `TestNoSecondWorkContextImplementation` holds both: the pin at or
33-
after that commit, and nothing in this module naming the deleted verifier's
34-
surface.
33+
deleted.
3534

3635
`Authenticator` is the entrypoint for a party that verifies **without
3736
minting**. It assembles core's `Verifier` and calls `Verify`, so there is one

‎docs/supported-matrix.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,11 @@ When `go.mod` moves to a new core release line, update the `core` field in
2727
`go test ./pkg/conformance/...` before the full coverage and race gates.
2828
`TestMatrixCoreMatchesGoMod` refuses a stale declared version.
2929

30-
The current pin is the released core `v0.19.2`. On top of `v0.19.1`, it adds a
30+
The current pin is the released core `v0.19.4`. On top of `v0.19.2`, it adds
31+
the issuer's non-consuming `Authority.ReadBack` and moves kustomize back to
32+
`v0.21.1`, whose kube-openapi does not pull `structured-merge-diff/v7` (the
33+
`v0.21.3` that `v0.19.2` and `v0.19.3` carried broke every build compiling
34+
client-go). `v0.19.2` added a
3135
solution manifest's scoped `api.consumes` and its consumption contract (#784)
3236
and an issuer-assigned Work Context session (#783). `v0.19.1`
3337
verifies delivered carriers

‎go.mod‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,10 @@ require (
1111
github.com/asottile/dockerfile v3.1.0+incompatible
1212
github.com/blang/semver v3.5.1+incompatible
1313
github.com/briandowns/spinner v1.23.2
14-
github.com/codefly-dev/core v0.19.2
14+
github.com/codefly-dev/core v0.19.4
1515
github.com/codefly-dev/golor v0.1.3
1616
github.com/codefly-dev/llm v0.1.7
17-
github.com/codefly-dev/sdk-go/workcontext v0.0.0-20261007181327-535084e1872d
17+
github.com/codefly-dev/sdk-go/workcontext v0.1.0
1818
github.com/compose-spec/compose-go v1.20.2
1919
github.com/creack/pty v1.1.24
2020
github.com/docker/docker v28.5.2+incompatible
@@ -53,8 +53,8 @@ require (
5353
google.golang.org/protobuf v1.36.12
5454
gopkg.in/yaml.v3 v3.0.1
5555
oras.land/oras-go/v2 v2.6.2
56-
sigs.k8s.io/kustomize/api v0.21.3
57-
sigs.k8s.io/kustomize/kyaml v0.21.3
56+
sigs.k8s.io/kustomize/api v0.21.1
57+
sigs.k8s.io/kustomize/kyaml v0.21.1
5858
)
5959

6060
require (
@@ -100,6 +100,7 @@ require (
100100
github.com/containerd/typeurl/v2 v2.3.0 // indirect
101101
github.com/creativeprojects/go-selfupdate v1.6.0 // indirect
102102
github.com/cyphar/filepath-securejoin v0.7.0 // indirect
103+
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
103104
github.com/davidmz/go-pageant v1.0.2 // indirect
104105
github.com/dekobon/tree-sitter-groovy v0.3.0 // indirect
105106
github.com/distribution/reference v0.6.0 // indirect
@@ -124,10 +125,14 @@ require (
124125
github.com/go-openapi/loads v0.25.3 // indirect
125126
github.com/go-openapi/spec v1.0.1 // indirect
126127
github.com/go-openapi/strfmt v0.27.2 // indirect
128+
github.com/go-openapi/swag v0.29.2 // indirect
129+
github.com/go-openapi/swag/cmdutils v0.29.2 // indirect
127130
github.com/go-openapi/swag/conv v0.29.2 // indirect
131+
github.com/go-openapi/swag/fileutils v0.29.2 // indirect
128132
github.com/go-openapi/swag/jsonutils v0.29.2 // indirect
129133
github.com/go-openapi/swag/loading v0.29.2 // indirect
130134
github.com/go-openapi/swag/mangling v0.29.2 // indirect
135+
github.com/go-openapi/swag/netutils v0.29.2 // indirect
131136
github.com/go-openapi/swag/pools v0.29.2 // indirect
132137
github.com/go-openapi/swag/stringutils v0.29.2 // indirect
133138
github.com/go-openapi/swag/typeutils v0.29.2 // indirect
@@ -235,6 +240,6 @@ require (
235240
google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect
236241
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
237242
gopkg.in/warnings.v0 v0.1.2 // indirect
238-
k8s.io/kube-openapi v0.0.0-20261001230523-97fa35140926 // indirect
243+
k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
239244
sigs.k8s.io/yaml v1.6.0 // indirect
240245
)

‎go.sum‎

Lines changed: 19 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -101,16 +101,16 @@ github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJ
101101
github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
102102
github.com/cloudflare/circl v1.6.5 h1:O64F26HEqNhznd/hrC5KZXVKYuKM2rx4deZDTc4ihQA=
103103
github.com/cloudflare/circl v1.6.5/go.mod h1:h5LNyxAc5nTue9DS5jT+48en2PSDYt3zdGnz5OstK6c=
104-
github.com/codefly-dev/core v0.19.2 h1:eoto82yKQPxLvtn5ie0hk7MYtTGTvikjkQjcaUuQtso=
105-
github.com/codefly-dev/core v0.19.2/go.mod h1:4ovwm7kaHFtY9+TT8yfjA4D/BiAhIFZez7lcil8muVo=
104+
github.com/codefly-dev/core v0.19.4 h1:vUvaFrWkB8B3ksQY/qlgBTVj3jMNhdEpJca8aofaals=
105+
github.com/codefly-dev/core v0.19.4/go.mod h1:0uX/7lTBVaGV0RI2Mb3mpEr/PPdx/jZqXHym/U8FVDI=
106106
github.com/codefly-dev/golor v0.1.3 h1:xmo+ceyJFRYZdvpWE2fNd0jeaadp/Ibm1BnganiGKOc=
107107
github.com/codefly-dev/golor v0.1.3/go.mod h1:sl/u/K1l7J0Pr3xyVZp8fOJYQItKKst1No9JqgzLLoY=
108108
github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ=
109109
github.com/codefly-dev/gortk v0.2.0/go.mod h1:dDWUMFgAP063OCGhTEpV7FFUj9+zTcxxO/nV80VKEwg=
110110
github.com/codefly-dev/llm v0.1.7 h1:eU1PXoxVnP51/yx5kqrDby3+HBfH9mRz3kafJtjiaz8=
111111
github.com/codefly-dev/llm v0.1.7/go.mod h1:jwZgUAK1Qd7NK4f/IWUXE+zhwoSkxtQtQNMeiHkZZ8o=
112-
github.com/codefly-dev/sdk-go/workcontext v0.0.0-20261007181327-535084e1872d h1:grVxnZFZ33wYcmpoY854Qz9WDcct1PozYa5FyWk0LyM=
113-
github.com/codefly-dev/sdk-go/workcontext v0.0.0-20261007181327-535084e1872d/go.mod h1:FeKytaeqEXRigN5UflAjVeoMoV2gEN2oJLgBBgpr0Jg=
112+
github.com/codefly-dev/sdk-go/workcontext v0.1.0 h1:oFU/Lg1xnlibRPqyKR0KGdgGttwH8EdZIuErqBaRZxo=
113+
github.com/codefly-dev/sdk-go/workcontext v0.1.0/go.mod h1:FeKytaeqEXRigN5UflAjVeoMoV2gEN2oJLgBBgpr0Jg=
114114
github.com/compose-spec/compose-go v1.20.2 h1:u/yfZHn4EaHGdidrZycWpxXgFffjYULlTbRfJ51ykjQ=
115115
github.com/compose-spec/compose-go v1.20.2/go.mod h1:+MdqXV4RA7wdFsahh/Kb8U0pAJqkg7mr4PM9tFKU8RM=
116116
github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -130,6 +130,8 @@ github.com/cyphar/filepath-securejoin v0.7.0 h1:s0Y3ITPy6sQn5xt54DuYvTF8hu134ooY
130130
github.com/cyphar/filepath-securejoin v0.7.0/go.mod h1:ymLGms/u3BYaviIiuKFnUx8EkQEZeK6cInNoAPJA3o4=
131131
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
132132
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
133+
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
134+
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
133135
github.com/davidmz/go-pageant v1.0.2 h1:bPblRCh5jGU+Uptpz6LgMZGD5hJoOt7otgT454WvHn0=
134136
github.com/davidmz/go-pageant v1.0.2/go.mod h1:P2EDDnMqIwG5Rrp05dTRITj9z2zpGcD9efWSkTNKLIE=
135137
github.com/dekobon/tree-sitter-groovy v0.3.0 h1:bLi4b7WAQr6Q7nGw529JTHr+jmqvo4yK6nkmGbYQRFU=
@@ -199,8 +201,13 @@ github.com/go-openapi/spec v1.0.1/go.mod h1:M//GWQGtDUAjnP37gE6fInLgaczB+FatoipV
199201
github.com/go-openapi/strfmt v0.27.2 h1:SG32SlbwNy92s0KJiVxt2joJeFdqIYHvwrA0OU6HqzQ=
200202
github.com/go-openapi/strfmt v0.27.2/go.mod h1:M4CKsMO0Fb8qR10+1Ra75wCKNNquy+Vj+4LWZrhTo2E=
201203
github.com/go-openapi/swag v0.29.2 h1:9n8frkcsuQRA0INU31VbxNxt1zBaHxrHYGEf5BUjFi4=
204+
github.com/go-openapi/swag v0.29.2/go.mod h1:RkCiX1gCVXWgLOavDXE3ALJrQ/VO2ziiIzOUs3z10xo=
205+
github.com/go-openapi/swag/cmdutils v0.29.2 h1:cXEzX/nWCODon251f+1HgL75/R4XXML5IZxgLCWMoro=
206+
github.com/go-openapi/swag/cmdutils v0.29.2/go.mod h1:XziaSVzYqkDvpWXzASfWajw2YvJrLscq610O2XiyqJw=
202207
github.com/go-openapi/swag/conv v0.29.2 h1:8c9shoB8l0QRSR6ymq1llHdBWDqpIgJfjTGHx3Vuhm0=
203208
github.com/go-openapi/swag/conv v0.29.2/go.mod h1:AZS0YigTNf8qNtD6WqJz/N4RUNmpr76SyjFGkq4+p6Q=
209+
github.com/go-openapi/swag/fileutils v0.29.2 h1:mdUL+Vw5ah1fO1AvFCoHeIyv7YZsCz2MN3KNqd/lLVI=
210+
github.com/go-openapi/swag/fileutils v0.29.2/go.mod h1:7QKmmodjAebaq61lGVJa8ldLdGeMF4DSgYv8tXOGGo0=
204211
github.com/go-openapi/swag/jsonutils v0.29.2 h1:uZNSD2/rJDYAfvsLYkykTzXuyxM3QpDKV9jhRHrMu6k=
205212
github.com/go-openapi/swag/jsonutils v0.29.2/go.mod h1:ONTdNvj3Y+IXRzfa17E+Rgt2ns/qiSOYjIo2K7v2yDs=
206213
github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.2 h1:w+Fd6EBOMGlC74GYGHqCLGyb3Bpams8TtNrgM/SG4jo=
@@ -209,6 +216,8 @@ github.com/go-openapi/swag/loading v0.29.2 h1:QU1ry24e6r6Shoxe380Nx0X5iKkpRO+hJf
209216
github.com/go-openapi/swag/loading v0.29.2/go.mod h1:DqilDjuiJKETecsS4TRopWG1acUDsfqN39ZmQhPu6uI=
210217
github.com/go-openapi/swag/mangling v0.29.2 h1:ltdo3K0tTP4P6zWhVVWDU9D37/YYBuMJRdZxiS2Dtog=
211218
github.com/go-openapi/swag/mangling v0.29.2/go.mod h1:RjDi4TnItAenS3cgCXSpIl1kKbjG7il6pnmQVl/8bp8=
219+
github.com/go-openapi/swag/netutils v0.29.2 h1:dBli6jyUa93sDS/XYWShJzf4+nnVfFKfvY9SLUaUzB8=
220+
github.com/go-openapi/swag/netutils v0.29.2/go.mod h1:1pM6Xg/Um8E1eps3umWl8Hme3ByWXOtHsvFC0CULHUE=
212221
github.com/go-openapi/swag/pools v0.29.2 h1:PlGoDRF8WtSyXkedZZkpW3f9wDhFf3u8KtaBcmgmh8c=
213222
github.com/go-openapi/swag/pools v0.29.2/go.mod h1:V3lhxVT4qDYRqc2MRSSbLsTYIYV/2HlHafhyEkmzLIc=
214223
github.com/go-openapi/swag/stringutils v0.29.2 h1:lcnBxwAaysT3bMUVBfn9V/PkfVqkurpqufKU6rTUMGk=
@@ -587,16 +596,16 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
587596
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
588597
gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
589598
gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
590-
k8s.io/kube-openapi v0.0.0-20261001230523-97fa35140926 h1:Fe0G8t8FaMDn2lpat0IHu3X9lHrVyGzDxhhCwKXKp28=
591-
k8s.io/kube-openapi v0.0.0-20261001230523-97fa35140926/go.mod h1:3e2VxsK2svhjvkNik92kYU1a5kgau5tZeAuEWwoN4q0=
599+
k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
600+
k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
592601
oras.land/oras-go/v2 v2.6.2 h1:N04RXngAp1LJKTG6ifz3xHPipasEkWr+hFmInja5YKo=
593602
oras.land/oras-go/v2 v2.6.2/go.mod h1:PlTtg4JTDJkDe8yVHpM2wz7/YDc00GVas+i4jAW2TZ4=
594603
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
595604
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
596-
sigs.k8s.io/kustomize/api v0.21.3 h1:DXGrbifGrAd+7AQ75Kx/tVhr+RLMCZFfAYl61HOR3T0=
597-
sigs.k8s.io/kustomize/api v0.21.3/go.mod h1:JKlHjHXGh54cdoWVdKNqDscFzPb9z+sBk9upy9PBh6k=
598-
sigs.k8s.io/kustomize/kyaml v0.21.3 h1:4ygzLsc8B1ep9dFuEivrJ2lFIAglL19dhPrWp1ioceY=
599-
sigs.k8s.io/kustomize/kyaml v0.21.3/go.mod h1:HrAVNlYyEphOlRCcaSIQziGR+0ehwx6Xp1ucUrpC6hs=
605+
sigs.k8s.io/kustomize/api v0.21.1 h1:lzqbzvz2CSvsjIUZUBNFKtIMsEw7hVLJp0JeSIVmuJs=
606+
sigs.k8s.io/kustomize/api v0.21.1/go.mod h1:f3wkKByTrgpgltLgySCntrYoq5d3q7aaxveSagwTlwI=
607+
sigs.k8s.io/kustomize/kyaml v0.21.1 h1:IVlbmhC076nf6foyL6Taw4BkrLuEsXUXNpsE+ScX7fI=
608+
sigs.k8s.io/kustomize/kyaml v0.21.1/go.mod h1:hmxADesM3yUN2vbA5z1/YTBnzLJ1dajdqpQonwBL1FQ=
600609
sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
601610
sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
602611
sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=

‎pkg/conformance/matrix.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": 1,
33
"cli": "source",
4-
"core": "v0.19.2",
4+
"core": "v0.19.4",
55
"rows": [
66
{
77
"id": "linux-amd64-source",

‎pkg/gitops/cluster_scope_test.go‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
package gitops
2+
3+
import (
4+
"testing"
5+
6+
"github.com/stretchr/testify/require"
7+
"sigs.k8s.io/kustomize/kyaml/openapi"
8+
)
9+
10+
// clusterScopedKyamlForgets exists only while the pinned kyaml has no answer
11+
// for these kinds. Once it has one, kyaml's answer is used and the table is
12+
// dead: delete it, and this test with it.
13+
func TestKyamlStillForgetsTheAdmissionPolicyScopes(t *testing.T) {
14+
for typeMeta := range clusterScopedKyamlForgets {
15+
_, known := openapi.IsNamespaceScoped(typeMeta)
16+
require.False(t, known, "kyaml now knows the scope of %s: delete clusterScopedKyamlForgets", typeMeta.Kind)
17+
}
18+
}
19+
20+
// An admission policy reaches every namespace, so it needs the AppProject's
21+
// cluster authority whatever the pinned kyaml knows about it.
22+
func TestAdmissionPoliciesNeedClusterAuthority(t *testing.T) {
23+
for _, kind := range []string{"ValidatingAdmissionPolicy", "ValidatingAdmissionPolicyBinding"} {
24+
t.Run(kind, func(t *testing.T) {
25+
manifests, _, err := decodeYAML("policy.yaml", []byte("apiVersion: admissionregistration.k8s.io/v1\nkind: "+kind+"\nmetadata:\n name: shared\n namespace: alpha\n"))
26+
require.NoError(t, err)
27+
require.Len(t, manifests, 1)
28+
require.True(t, manifests[0].knownClusterScoped())
29+
require.ErrorContains(t, validateManifest(manifests[0], nil, true), "cluster-scoped "+kind+" is outside an AppProject contract")
30+
})
31+
}
32+
}

‎pkg/gitops/object_identity.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,9 @@ func validateObjectIdentities(documents []manifest, namespace string) error {
3838
identities := []objectIdentity{id}
3939
// Namespace-free output may be cluster-scoped. Index it globally as
4040
// well as at its applying destination, without a brittle kind roster.
41-
if metadataString(doc.value, keyNamespace) == "" && id.namespace != "" {
41+
// A known cluster-scoped object is global even when a namespace
42+
// transformer that did not know its scope stamped one on it.
43+
if (metadataString(doc.value, keyNamespace) == "" || doc.knownClusterScoped()) && id.namespace != "" {
4244
global := id
4345
global.namespace = ""
4446
identities = append(identities, global)

‎pkg/gitops/render.go‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1680,5 +1680,22 @@ func hostsDeliveryAPI(opts *RenderOptions) bool {
16801680
// uniqueness never depends on this partial scope knowledge.
16811681
func (item manifest) knownClusterScoped() bool {
16821682
apiVersion, _ := item.value[keyAPIVersion].(string)
1683-
return openapi.IsCertainlyClusterScoped(kyaml.TypeMeta{APIVersion: apiVersion, Kind: item.kind})
1683+
typeMeta := kyaml.TypeMeta{APIVersion: apiVersion, Kind: item.kind}
1684+
if _, known := openapi.IsNamespaceScoped(typeMeta); !known {
1685+
return clusterScopedKyamlForgets[typeMeta]
1686+
}
1687+
return openapi.IsCertainlyClusterScoped(typeMeta)
1688+
}
1689+
1690+
// clusterScopedKyamlForgets holds the cluster-scoped kinds kyaml v0.21.3 knows
1691+
// and the pinned v0.21.1 does not. kustomize v0.21.3's kube-openapi requires
1692+
// structured-merge-diff/v7, which breaks every client-go build, so core v0.19.4
1693+
// holds kustomize at v0.21.1; without this table an admission policy would
1694+
// read as namespaced and escape the AppProject's cluster-resource check.
1695+
// It is consulted only when kyaml has no answer, and
1696+
// TestKyamlStillForgetsTheAdmissionPolicyScopes fails once it has one, at which
1697+
// point this table is deleted.
1698+
var clusterScopedKyamlForgets = map[kyaml.TypeMeta]bool{
1699+
{APIVersion: "admissionregistration.k8s.io/v1", Kind: "ValidatingAdmissionPolicy"}: true,
1700+
{APIVersion: "admissionregistration.k8s.io/v1", Kind: "ValidatingAdmissionPolicyBinding"}: true,
16841701
}

0 commit comments

Comments
 (0)