Independently reviewed virdx/infra_k8s PR #196 against origin/main.
Checked the new build-metadata ClusterPolicy, the Kyverno Helm CA configuration, and the unrelated run-image AWS credential mounts in the PR.
Compared the policy with sibling policy conventions and the Tekton metadata producers.
Validated the ClusterPolicy with Kubernetes server-side dry-run and Kyverno CLI v1.16.2.
Rendered Kyverno chart 3.8.1 with the proposed values.
Ran util/lint-manifests, util/lint-docs, and git diff --check; all passed.
Found no concrete actionable Kubernetes or Kyverno semantic defect.
Lessons Learned: Pitfalls
The knowledge repository’s plain git pull --ff-only reported “Cannot fast-forward to multiple branches” despite one configured merge ref. An explicit git fetch origin main followed by git merge --ff-only origin/main worked.
The repository lint scripts require yq, which was not on PATH; a temporary downloaded binary was sufficient.
Lessons Learned: Improvements
Keep the target Kyverno CLI version near the chart version available in operator tooling. It makes policy precondition and context-loading behavior easy to verify locally.
Document a fallback explicit fetch/merge command for knowledge checkouts where plain git pull is affected by global Git configuration.
