The CA-source writer policy is two CEL expressions, and until an engine
converges onto the label leg nothing exercises them against the API
server: helm-unittest pins the expressions verbatim and the bats check
pins the writer identity, but a CEL that is wrong as written would satisfy
both while admitting a forged trust-anchor source.
Add a chainsaw suite that impersonates a non-cert-manager identity and
asserts the API server denies both attack shapes — forging a new labelled
source and stripping the label off an existing one to evade the gate —
while cert-manager itself stays allowed, which also guards against a
policy that denies everyone.
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Aleksei Sviridkin
2855ba4677