Compile the committed WebApp graph with the pinned KRO release #5195

🤖 Generated by the Agentic Engineer

Objective

Compile the committed WebApp graph with the same KRO release the platform deploys, before introducing the runtime inputs needed for public business-site staging.

Details

The public staging prerequisite #5163 cannot safely rely on YAML rendering or the existing Kyverno engine fixture as proof that KRO accepts its expressions. The deployed chart is 0.9.2. Its conditional omission function is an alpha feature disabled by default, and the current Helm values do not enable it. The current three-resource graph has no direct compiler test.

Add an isolated API-server fixture using the pinned KRO library and actual Kubernetes discovery/OpenAPI, compiling the repository's real graph rather than a copied workload. It must not use ambient kubeconfig, secrets, a local/production cluster, or customer data. Preserve the deployed feature-gate state. This is a durable compiler check, not controller convergence, kubelet projection, a runtime-input implementation or portal activation.

Priority High: this removes an untested prerequisite from the maintainer-requested portal deployment path. Effort Medium including pinned dependency review, actual API-server execution, CI, exact-head review and protected merge. Standard service class. Success proxy: the committed graph compiles; deliberate invalid references and type changes are rejected; omitting the fixture or leaving it unexecuted cannot produce a passing required result. Observe before and after merge.

Checklist

• Bind the test library to the committed controller chart version and preserve the actual omission feature-gate setting; mismatch or unreadable inputs fail.
• Compile the exact committed WebApp with real API discovery, including its Deployment, Service and HTTPRoute, and assert all three resources and generated namespaced WebApp schema are present.
• Independently reject invalid CEL references and output types, malformed or empty graphs, and use of conditional omission while its deployed gate is disabled.
• Run the check on the applicable PR and merge-group paths with finite deadlines and teardown; a missing fixture result fails the required aggregate.
• Keep the live graph, controller values, tenant policies, image controls and private portal state unchanged. Clearly distinguish compiler/API proof from controller/kubelet/runtime proof.
• Validate the source invocation and negative controls, obtain substantive current-head review and CI, merge normally, and read back post-merge execution.

Dependencies

Part of #5163. This check is independently shippable before its optional runtime schema is chosen; #5163 remains open for that schema, reconciliation, strict input rejection and actual business-image proof.

Notes

No new service, credentials, recurring spend, policy exception or customer access is introduced. The first fixture uses the existing reviewed isolated API-server approach, not a full Kubernetes cluster.