From c78bc3f8dc39db4318fe3d15763bd0ce39f47eaf Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Mon, 13 Jul 2026 14:47:55 +0200 Subject: [PATCH 1/2] feat(repos): declare devantler-tech/kyverno-policies (shared Kyverno policy library) Co-Authored-By: Claude Fable 5 --- deploy/repositories/kustomization.yaml | 1 + deploy/repositories/kyverno-policies.yaml | 51 +++++++++++++++++++++++ 2 files changed, 52 insertions(+) create mode 100644 deploy/repositories/kyverno-policies.yaml diff --git a/deploy/repositories/kustomization.yaml b/deploy/repositories/kustomization.yaml index 0a8169e..a119314 100644 --- a/deploy/repositories/kustomization.yaml +++ b/deploy/repositories/kustomization.yaml @@ -17,6 +17,7 @@ resources: - provider-upjet-unifi.yaml - unifi.yaml - aws.yaml + - kyverno-policies.yaml - gitops-tenant-template.yaml - platform-template.yaml - go-template.yaml diff --git a/deploy/repositories/kyverno-policies.yaml b/deploy/repositories/kyverno-policies.yaml new file mode 100644 index 0000000..886f868 --- /dev/null +++ b/deploy/repositories/kyverno-policies.yaml @@ -0,0 +1,51 @@ +apiVersion: repo.github.m.upbound.io/v1alpha1 +kind: Repository +metadata: + name: kyverno-policies + annotations: + # NET-NEW repo (not an adoption). The provider's create POST cannot send the + # org's 5 required custom properties (no CRD field), so it 422s until the + # repo is bootstrapped ONCE by an org admin with `gh api -X POST + # /orgs/devantler-tech/repos` including `custom_properties` (Type= + # Infrastructure + the 4 defaults) — see platform#2325. This CR then + # observes + adopts it and manages it declaratively from there on. + # external-name pinned so the create/observe target is unambiguous. + crossplane.io/external-name: kyverno-policies +spec: + # Same all-except-Delete policy as every other managed repo (omitting Delete + # guarantees Crossplane can never delete a real GitHub repository). + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + name: kyverno-policies + description: "Shared Kyverno policy library for the devantler-tech platforms — the single source the platform and platform-template consume instead of vendoring per-repo copies." + visibility: public + hasIssues: true + # Shared kustomization patch supplies the squash-only merge policy + + # webCommitSignoffRequired; nothing repo-specific needed here. + providerConfigRef: + kind: ProviderConfig + name: default +--- +apiVersion: repo.github.m.upbound.io/v1alpha1 +kind: DefaultBranch +metadata: + name: kyverno-policies + annotations: + # The Repository CRD's defaultBranch field is deprecated; manage the + # already-existing main branch through the dedicated resource instead. + crossplane.io/external-name: kyverno-policies +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + branch: main + providerConfigRef: + kind: ProviderConfig + name: default From 492dbd62235afd4fa0a5476ebc6b910ba872c746 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Mon, 13 Jul 2026 16:28:11 +0200 Subject: [PATCH 2/2] fix(deploy): grant maintainers team + org label taxonomy on kyverno-policies Codex P2s: the new repo declaration lacked the TeamRepository grant (ownership goes to teams) and the IssueLabels wiring, leaving it owner-only with default labels. Both follow the aws net-new pattern; kustomize renders the grant and all 22 canonical labels. Co-Authored-By: Claude Fable 5 --- deploy/labels/kustomization.yaml | 1 + deploy/labels/kyverno-policies.yaml | 22 +++++++++++++++++++ ...grant-maintainers-on-kyverno-policies.yaml | 16 ++++++++++++++ deploy/team-repositories/kustomization.yaml | 1 + 4 files changed, 40 insertions(+) create mode 100644 deploy/labels/kyverno-policies.yaml create mode 100644 deploy/team-repositories/grant-maintainers-on-kyverno-policies.yaml diff --git a/deploy/labels/kustomization.yaml b/deploy/labels/kustomization.yaml index 2e1e152..73c22da 100644 --- a/deploy/labels/kustomization.yaml +++ b/deploy/labels/kustomization.yaml @@ -31,6 +31,7 @@ resources: - provider-upjet-unifi.yaml - unifi.yaml - aws.yaml + - kyverno-policies.yaml - gitops-tenant-template.yaml - platform-template.yaml - go-template.yaml diff --git a/deploy/labels/kyverno-policies.yaml b/deploy/labels/kyverno-policies.yaml new file mode 100644 index 0000000..84383d4 --- /dev/null +++ b/deploy/labels/kyverno-policies.yaml @@ -0,0 +1,22 @@ +# Issue labels for devantler-tech/kyverno-policies. The canonical org taxonomy (22 labels) +# is appended to every IssueLabels by the shared patch in kustomization.yaml; this +# file adds only kyverno-policies's repo-specific extras. See ../README.md. +apiVersion: repo.github.m.upbound.io/v1alpha1 +kind: IssueLabels +metadata: + name: kyverno-policies + annotations: + crossplane.io/external-name: kyverno-policies +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: kyverno-policies + # No repo-specific extras; the shared patch supplies the full canonical set. + label: [] + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/team-repositories/grant-maintainers-on-kyverno-policies.yaml b/deploy/team-repositories/grant-maintainers-on-kyverno-policies.yaml new file mode 100644 index 0000000..5a2529e --- /dev/null +++ b/deploy/team-repositories/grant-maintainers-on-kyverno-policies.yaml @@ -0,0 +1,16 @@ +# Team → repository access. No external-name: this grant does not exist yet, so it is +# Created (full management except Delete) rather than adopted. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-kyverno-policies +spec: + managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] + forProvider: + teamIdRef: + name: maintainers + repository: kyverno-policies + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/team-repositories/kustomization.yaml b/deploy/team-repositories/kustomization.yaml index f9f4e9e..b538bab 100644 --- a/deploy/team-repositories/kustomization.yaml +++ b/deploy/team-repositories/kustomization.yaml @@ -20,3 +20,4 @@ resources: - grant-maintainers-on-homebrew-tap.yaml - grant-maintainers-on-provider-upjet-unifi.yaml - grant-maintainers-on-aws.yaml + - grant-maintainers-on-kyverno-policies.yaml