Preserve the public listener guard while migrating its validation API #5464

🤖 Generated by the Agentic Engineer

Objective

Preserve the public-only listener configuration boundary while moving its retiring ClusterPolicy API to ValidatingPolicy. This is a bounded slice of #4995, with independent deployment and acceptance.

Existing evidence

The four current listener fixture families contain six literal outcomes: the approved public configuration passes, the same reserved name in another namespace fails, an unrelated name is excluded, and changed listener content, extra data and binary data are denied. All six outcomes pass on both Kyverno 1.19.1 and the repository's current 1.19.2 CLI. The existing rule enforces admission and retains background reporting.

Acceptance criteria

• Retain those six original resource/outcome cases and old-policy baseline receipts. Characterize CREATE, UPDATE, DELETE and absent/null/empty inputs before rewriting; retain the existing decision where an operation is matched. Negative controls must prove each independent protection is evaluated.
• Preserve the reserved resource/name scope, namespace boundary, exact allowed public content, data/binary-data restrictions, failure action and background reporting. A format migration must not introduce new listener behavior or permissions.
• Deploy the replacement alongside the unchanged legacy policy. Verify the replacement's webhook, reporting permissions and readiness against the actual published source before proposing legacy removal in a separate protected change.
• Keep the fixtures bound to the replacement alone, preserve effective failure-action validation, and pass applicable regressions, the fixture-evaluation guard, naming checks, manifest-layer builds and static schema validation. Obtain current-head substantive review and normal protected delivery.
• Complete the removal only after the first deployment is accepted, then read back the replacement Ready and the old ClusterPolicy absent at the delivered revision. Keep this issue open until that final runtime acceptance.

Scope and planning

Part of #4995. Priority High; Effort Low; Service class Risk reduction. Existing configuration and credential handling stay within their current boundaries; the work changes the validation API, not the listener configuration. No additional service, subscription or local cluster is needed.