⭐ Add Kyverno Kubernetes resources

[MaxRink]

Summary

• add first-class k8s.kyverno resources for policies, rules, reports/results, PolicyExceptions, and mappings
• collect Kyverno classic policies, policies.kyverno.io resources, PolicyReports/OpenReports, and PolicyExceptions through the Kubernetes provider
• enrich Kyverno results and PolicyExceptions with annotation-induced and built-in Mondoo mappings
• expose plural mapped Mondoo check UID/MRN fields on Kyverno results for one-to-many rule mappings
• prefer policy annotation mappings over built-in defaults for both results and PolicyExceptions
• update built-in mappings to current official Kyverno metadata/rule names and carry confidence for partial mappings
• align runtime built-ins with every reviewed catalog policy/rule pair, including partial hostPath, hostPort, hostPort range, HostProcess, procMount, safe sysctls, SELinux type/user/role controls, seccomp profile controls, strict seccomp partial posture, ephemeral container blocking, non-root group IDs, hostPath PersistentVolume, container socket, service account token, ServiceAccount long-lived Secret references, Secret ServiceAccount token types, Secret environment variable usage, named container port usage, RBAC cluster-admin bindings, high-risk system group bindings, wildcard RBAC verbs/resources, Secret read verbs, RBAC escalation verbs, ClusterRole nodes/proxy access, service mesh, PSP, PodSecurity profile/subrule, default resources, default securityContext, restricted volume types, imagePull, image checksum, bare pods, ServiceAccount, PSS restricted profile mutation, QoS/resource posture, memory request/limit posture, Service exposure, Ingress routing/TLS, namespace inventory, Deployment replica count, StorageClass, NetworkPolicy podSelector, recommended Pod app labels, digest-resolution, and Kubernetes Best Practices mappings
• support built-in mappings to non-default Mondoo policies such as mondoo-kubernetes-best-practices
• fix k8s.serviceaccount secrets/imagePullSecrets field construction to return array data for their declared []dict type
• fix container, initContainer, and ephemeralContainer env/envFrom schema declarations to expose generated []dict data
• cover the current policies.kyverno.io/v1 PolicyException shape, where policyRefs no longer carry rule names
• map rule-less modern PolicyExceptions to the referenced policy's mapped rules while preserving broad status
• compute applied PolicyException status when matching PolicyReport/OpenReports evidence is observed, unless a higher-severity status wins
• add provider options for configurable mapping annotation keys, PolicyException metadata annotation keys, built-in default mapping enablement, PolicyException behavior defaults, and unmapped PolicyReport result reporting
• expose Kyverno behavior settings on k8s.kyverno for mirroring intent, mirrored approval/action, expired-exception strictness, unmapped-exception reporting, and unmapped-result reporting

Verification

• make providers/build/k8s
• go test ./provider -run 'TestK8sServiceAccount' -count=1
• go test ./resources -run 'TestKyvernoManifestResources|TestKyvernoBuiltinMappingsCoverReviewedCatalogPolicies|TestKyvernoBuiltinMappingsSupportBestPracticesPolicy' -count=1
• go test ./resources -run 'TestKyvernoBuiltinMappings|TestKyvernoManifestResources|TestKyvernoPolicyExceptions|TestKyvernoPolicyReports' -count=1
• go test ./resources -run 'TestKyvernoBuiltinMappings|TestKyvernoPolicyExceptions|TestKyvernoPolicyReports' -count=1
• go test ./resources -run 'TestKyvernoBuiltinMappingsCoverReviewedCatalogPolicies|TestKyvernoBuiltinMappingsSupportBestPracticesPolicy|TestKyvernoManifestResources|TestKyvernoPolicyExceptions|TestKyvernoPolicyReports' -count=1
• go test ./config ./resources ./connection/manifest ./provider
• git diff --check
• live kind smoke with Kyverno chart 3.8.1 / Kyverno v1.18.1 using a local cnspec build plus local provider cache: all six Kyverno smoke checks passed

Notes

This is read-only collection through the existing Kubernetes scanner path and does not add anything to the admission path. The live Kyverno v1.18.1 CRD rejects old match/ruleNames fields on policies.kyverno.io/v1 PolicyException, so such exceptions keep an explicit broad status when rule names are absent. When the referenced Kyverno policy has known mappings, the exception is still attached to the related Mondoo checks so it can be displayed with the rest of the Kyverno and Mondoo exception context. Mirroring options are exposed as scanner intent, but native external exception upsert/display still requires platform API/UI support.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[MaxRink]

/review

[MaxRink]

I have read the Mondoo CLA Document and I hereby sign the CLA

[mondoo-code-review]

New Kyverno resource integration is well-structured; container env/envFrom type-change versions are missing and new files have wrong copyright format.

Superseded by new review

[mondoo-code-review]

Adds Kyverno policy engine integration to the K8s provider and fixes serviceaccount field types from dict to []dict.

[MaxRink]

/review

[mondoo-code-review]

Adds Kyverno policy engine integration to the K8s provider with well-structured resource schema and fixes a pre-existing env/envFrom type mismatch.

[MaxRink]

/review

[MaxRink]

/review

[mondoo-code-review]

Kyverno integration queries the Kubernetes API redundantly when default fields are accessed, doubling API calls for policies and exceptions.

[MaxRink]

/review

[mondoo-code-review]

Adds comprehensive Kyverno policy engine integration to the K8s provider with schema, implementation, and a service account bug fix.

[mondoo-code-review]

Adds Kyverno policy engine integration to the Kubernetes provider with schema, discovery, and configuration options.

[MaxRink]

/review

[mondoo-code-review]

Adds Kyverno policy engine integration to the K8s provider and fixes container env/envFrom schema types and serviceaccount secrets type.

[MaxRink]

/review

[mondoo-code-review]

Adds Kyverno resource schema and integration; serviceaccount type fix is correct; no production bugs found.

[MaxRink]

/review

[MaxRink]

/review

[mondoo-code-review]

Adds Kyverno policy engine integration to the K8s provider with schema, config options, and a service account bug fix; internal struct nil-dereference risk on cached resources is the main concern.

[MaxRink]

/review

[MaxRink]

/review

[mondoo-code-review]

Adds Kyverno policy engine resources to the K8s provider with a serviceaccount bug fix, but internal struct fields lack nil guards that could cause panics.

[mondoo-code-review]

Adds Kyverno policy engine integration to K8s provider with schema fixes for container env/envFrom types.

[MaxRink]

/review