security(render): guard against a render path acquiring a third network fetch #3442

🤖 Generated by the Agentic Engineer

First child of #3196, and the one that stops the problem growing while the other two are done.

Evidence

#3196 measured two render-time network fetches in the prod controllers render, one from Cloudflare's moving trunk branch. Re-measured today on main (2026-08-29): 116 kustomizations under k8s, 718 resource entries, exactly 3 remote — the same three, in the same two files. Nothing in CI reports them, and nothing stops a fourth appearing tomorrow.

Audience and impact

The reader is whoever next adds an upstream install bundle to a controller directory. Today the easy path — paste the upstream URL into resources: — is silently accepted, so the render keeps acquiring dependencies on third-party CDNs. Each one makes the prod render less reproducible and, where the bundle carries RBAC, feeds unreviewed documents into the authorization surface validate-eks-ci-role-policy exists to pin.

Hypothesis

The two live entries are being removed by #3196's children (2) and (3), which is vendoring work. The accumulation is a separate problem with a separate fix: a guard. Landing the guard first means the vendoring work happens against a tree that can no longer grow a third outlier, and the guard's exception list becomes the visible, owned record of exactly what is left.

Smallest useful change

A guard-render-remote-resources.sh in the shape of the repository's existing guards (guard-gitrepository-commit-pin.sh, guard-checkov-skip-reasons.sh), wired into the validate job behind the existing k8s path filter, plus a reviewed exceptions list carrying the two known entries so the guard runs green today rather than landing unwired.

Acceptance criteria

• A guard fails CI when a kustomization under k8s names a remote resources: / components: / bases: entry, or a helmCharts: remote repo:.
• The three entries security(render): prod render fetches third-party manifests unpinned, one from a moving branch #3196 names are recorded in a reviewed exceptions list; each row names a tracking issue and a reason, and a row whose URL is no longer referenced is itself a violation.
• The guard's verdict is pinned in all three directions (pass / reject / cannot-check), including a schemeless remote (github.com/org/repo//path?ref=v1, which contains no ://) and a local directory named like a host (cert-manager.k8s.cloudflare.com/), which must not be refused.
• An empty exceptions list — the state after security(render): prod render fetches third-party manifests unpinned, one from a moving branch #3196's children land — is a clean pass, not a failure.

Out of scope

Vendoring the two dependencies. Those are children (2) and (3) of #3196 and each removes its own exception row.

Rough size: S.