Cheat notes · Module 05 · Platform foundation

Guardrails and the namespace baseline

A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.

The idea

Self-service needs a consistent floor. One chart renders every product's namespace baseline from a few fields, and Kyverno policies stop anyone from eroding it: Audit in dev, Enforce in prod, and the same rules in CI.

Remember

Baseline as a chart: charts/product-namespace renders the Namespace, a ResourceQuota, a LimitRange, three NetworkPolicies and a RoleBinding from name, owner, cost center, Pod Security level and size.
Size profiles: teams pick small, medium or large; the platform decides what each means. More quota is a one-word pull request.
Policies: protect-platform-baseline blocks changes to baseline objects by anyone but the platform. require-requests-limits and disallow-latest-tag are Audit in dev, Enforce in prod (Kustomize overlays).
Same rules in CI: validate.sh runs the prod policies with the Kyverno CLI against every product's manifests, so violations fail the pull request, not the sync.
Prod changes need approval: a change under addons/*/overlays/prod makes production-gate wait for you.
The namespace carries Prune=false: removing a product from Git must not silently delete its data.

Pitfalls

An unpinned image (nginx:latest) with no requests: dev lets it in with warnings naming the policies, prod refuses it. Pin the tag and set requests and a memory limit.
Raising quota with kubectl: the policy blocks it on purpose. Change size in product.yaml by pull request.

Commands

`helm template checkout charts/product-namespace -f product.yaml --set environment=prod --set size=medium`	Render the baseline a product gets
`kubectl --context kind-prod get clusterpolicies`	The policies on a cluster
`kubectl --context kind-dev get clusterpolicy disallow-latest-tag -o jsonpath='{.spec.validationFailureAction}'`	`Audit` in dev, `Enforce` in prod

Test yourself

Answer in your head first, then open the answer.

A team needs more CPU quota in prod. What is the right change?

A pull request changing size for prod in its product.yaml.

Why are some policies Audit in dev and Enforce in prod?

Teams can experiment in dev and still see warnings; prod gets the hard rule.

Why is the product namespace annotated Prune=false?

Removing a product from Git must not silently delete its data. Deleting a namespace is a deliberate platform step.

Where module 05 leaves you: Kyverno policies run on both clusters (Audit in dev, Enforce in prod) and the product-namespace chart is ready to use. No product uses it yet: that is the next module.