security(rbac): evaluate chart-rendered RBAC against the privileged-RBAC policy in CI #3792

🤖 Generated by the Agentic Engineer

Evidence

#3791 enforces the privileged-RBAC policy with exact-identity exclusions. The excluded names are set by the Longhorn, Velero, Crossplane, KRO and KSail operator charts and their release names. Those charts render in-cluster through Flux, so no CI step ever evaluates their RBAC against the policy. A self-review of #3791 confirmed that every committed Role and ClusterRole under k8s/ passes: 47 pass, 0 fail. Nothing checks chart-rendered roles at all.

Audience and problem

This affects operators merging chart bumps. Suppose a Renovate bump renames an excluded role, or adds a new privileged one. It would be refused at admission, and Flux dry-runs through the same webhook, so the whole infrastructure-controllers Kustomization would fail. The merge-queue deploy's Ready proof would then fail for every queued PR. The bump's own PR would still show green.

Hypothesis and success signal

If CI renders those charts at their pinned versions and applies the policy to the output, the same bump fails on its own PR. The signal is a fixture bump that adds a privileged role to a rendered chart: it must fail CI. The current pins must pass.

Smallest useful change

1. Render the five charts at their committed versions and values with helm template in CI.
2. Run kyverno apply of audit-privileged-rbac.yaml over the rendered Roles and ClusterRoles.
3. Fail on any fail result.

Acceptance criteria

• CI renders each excluded chart at its pinned version and values, and applies the policy to the rendered RBAC.
• A rendered privileged role not in the exclusion list fails the PR, proven by a negative fixture.
• The current pins pass.
• The job runs when a HelmRelease for those charts, or the policy, changes.

Rough size: S–M.