Compare tenant route hostnames literally against the approved list #4527

🤖 Generated by the Agentic Engineer

Evidence

Found while checking the other cluster policies for the pattern #4517 fixes. The rules that limit which hostnames a tenant's routes may use compare the route's hostnames against the approved list with a Kyverno list operator, which reads * and ? in either operand as wildcards. Run offline against the current rule on Kyverno v1.19.1 (the version production runs): a route in a tenant namespace whose only hostname is a wildcard hostname covering the approved one is admitted, while a plainly different single hostname is refused as intended.

The four other policies that use a list operator were read as well and need no change: where the tenant writes the compared value, a wildcard can only make the rule refuse more (deny-lists on a kind), or the value is a Kubernetes object name or namespace, which cannot contain either character.

Problem and audience

The rule's own message says a route that claims every hostname on the shared listener is what it exists to stop. A wildcard hostname is the same claim one level down, and the allow-list does not stop it. The audience is the maintainer, who relies on this rule to keep one tenant's routes off hostnames that belong to the platform or to another tenant.

Expected behaviour

A tenant route is admitted only when every hostname it names is exactly one of that tenant's approved hostnames.

Acceptance criteria

• Both tenants' hostname rules compare each hostname literally, the way fix(github-config): compare tenant-written text literally in the team rules #4526 does for the team rules.
• Fixtures cover a wildcard hostname and a single-character wildcard for each tenant, beside an approved hostname as well as alone, and every asserted row is shown to evaluate.
• The routes running today are still admitted unchanged.
• After it is live, the policy is Ready and the tenants' routes are still accepted by the gateway.