feat(security): graduate zeroed Kubescape controls to Kyverno Enforce so they cannot regress #2855

🤖 Generated by the Agentic Engineer

Part of #2451 (its third slice). Depends on nothing in #2854 — the two can land independently.

Evidence

The CI posture gate is a regression floor on an aggregate score, deliberately set a few points under the observed value so it does not flake on run-to-run variance. That design is right for an aggregate, but it has a consequence: an individual control that has been driven to zero findings can regress back without crossing the aggregate floor, and nothing fails.

The cluster already runs both halves needed to close that: ClusterSecurityException CRs are the single source of truth for justified exceptions, and Kyverno is deployed and already enforcing policy at admission.

Problem

A control fixed at the manifest level stays fixed only as long as nobody reintroduces the pattern. Static scanning reports it after the fact; admission control prevents it. Today a fixed control has no ratchet, so the work of driving it to zero is not durable.

Proposed direction

For each control genuinely driven to zero, add the equivalent Kyverno policy and graduate it to Enforce, so the pattern is refused at admission rather than reported afterwards. Per the fix-vs-except ladder, this is the "runtime-enforce what a static scan cannot see" rung — and it is what makes the earlier fix permanent.

Practical sequencing matters more than coverage here:

• graduate one control at a time, Audit first, and read real admission decisions before flipping to Enforce
• a control still producing findings is not a candidate — graduating it would block legitimate deploys
• prefer the shared devantler-tech/kyverno-policies library over a repo-local copy where the rule is generic, so every consuming platform inherits the guardrail
• each graduation states, in its PR, both what the security floor gained and what the everyday deploy path cost — a guardrail that makes routine deploys harder is not ready

Success signal

Baseline: zero controls currently ratcheted, so any fixed control can silently regress. Target: each graduated control refuses its pattern at admission, evidenced by an admission decision in a test namespace rather than by the policy merely existing. Guardrail: no legitimate existing workload is blocked — measured in Audit before any flip.

Acceptance criteria

• At least one zeroed control is graduated end-to-end, with an observed admission refusal proving it actually fires (not just that the policy is installed).
• Audit-mode evidence is recorded before each Enforce flip, showing no legitimate workload would be blocked.
• Generic rules land in the shared policy library rather than being vendored here.
• The CI aggregate floor is ratcheted up, never down, as controls graduate.

Rough size: M, and naturally incremental — one control per PR.

Admission-readiness gate — 2026-10-05

The obsolete scanner blocker #2933 is closed. Fresh posture coverage is 102/102 result-bearing workload objects, but that denominator proves collection only, not that any individual control has zero findings. Select a candidate from per-control GET results after applicable exceptions, record legitimate workloads in Audit, and pair a positive admission with an observed refusal of the offending pattern before promotion. The broad admission objective stays open; do not flip all rules to Enforce or infer readiness from LIST payloads with stripped controls.