conformance: complete vpn-killswitch L3 test + ADR-0015 RBAC/fixtures

Turn the vpn-killswitch scaffold into a runnable SAFETY-CRITICAL L3 test for
R-NET-06 under ADR-0015 (node-level host OpenVPN tunnel steered by Cilium Egress
Gateway with a host nftables kill-switch), replacing the obsolete in-cluster
gluetun design.

- fixtures/vpn-and-internet-pods.yaml: two egress-class probe pods + documented
  RBAC/PodSecurity/namespace requirements for node-level fault injection.
- vpn-killswitch/chainsaw-test.yaml: GIVEN healthy tunnel (vpn egress != WAN);
  WHEN the host `vpn-egress-tunnel` systemd unit is STOPPED via a privileged,
  hostPID, node-pinned nsenter Job THEN vpn-class egress is blackholed (curl
  fails, never returns the WAN IP = no leak) while internet-class is unaffected;
  WHEN restarted THEN vpn egress recovers. spec-level `finally` ALWAYS runs an
  idempotent start Job (self-healing) so a mid-test failure never leaves the
  gateway tunnel down.
- incluster/rbac.yaml: grant the runner least-privilege for the delivered tests
  (namespaces create/delete/patch for the PSA relabel, pods/services/configmaps/
  pods-exec/pods-log, batch/jobs) and replace the gluetun-scale rule with the
  ADR-0015 host-systemd mechanism note (privilege via PodSecurity, not RBAC).

Offline validation: python yaml parse (all docs), `run.sh --lint` (structural),
`run.sh --coverage-only --strict-coverage` (no tag/annotation drift; R-NET-05/06/
07 covered, R-NET-06 has its L3 test), yamllint. No live apply, no cluster run.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

conformance/incluster/rbac.yaml

@@ -47,28 +47,46 @@ metadata:
   name: conformance-runner
   labels:
     app.kubernetes.io/part-of: conformance
-rules: []
+rules:
   # ---- Hermetic fixtures (all L2/L3): create/delete throwaway test namespaces + fixtures
-  # - apiGroups: [""]
-  #   resources: [namespaces]
-  #   verbs: [create, delete, get, list, watch]
-  # - apiGroups: [""]
-  #   resources: [pods, services, configmaps, secrets, persistentvolumeclaims]
-  #   verbs: [create, delete, get, list, watch, patch]
-  # - apiGroups: [""]
-  #   resources: [pods/exec]
-  #   verbs: [create]                       # probe exec for behavior assertions
+  - apiGroups: [""]
+    resources: [namespaces]
+    # `patch` is required by R-NET-06 (vpn-killswitch): the test relabels its own
+    # ephemeral namespace to PodSecurity enforce=privileged so it can launch the
+    # node-pinned privileged fault Job. Scoped to the per-test namespace only.
+    verbs: [create, delete, get, list, watch, patch]
+  - apiGroups: [""]
+    resources: [pods, services, configmaps, secrets, persistentvolumeclaims]
+    verbs: [create, delete, get, list, watch, patch]
+  - apiGroups: [""]
+    resources: [pods/exec]
+    verbs: [create]                         # probe exec for behavior assertions
+  - apiGroups: [""]
+    resources: [pods/log]
+    verbs: [get]                            # read fault/probe Job logs on failure
+  # ---- Probe / fault Jobs (R-TLS-01/03 tls-probe; R-NET-06 tunnel stop/start)
+  # `create` cannot be constrained by resourceNames, and the fault Job names are
+  # fixed per-test (tunnel-stop/tunnel-start/tunnel-start-finally); scoped by the
+  # in-namespace blast radius of the ephemeral test namespace.
+  - apiGroups: [batch]
+    resources: [jobs]
+    verbs: [create, delete, get, list, watch, patch]
   #
   # ---- R-NET-01/02 (default-deny, deny-undeclared): apply/patch/delete allow policies
   # - apiGroups: [cilium.io]
   #   resources: [ciliumnetworkpolicies]
   #   verbs: [create, delete, get, list, patch]
   #
-  # ---- R-NET-06 (VPN kill-switch): force the shared Gluetun gateway down/up
-  # - apiGroups: [apps]
-  #   resources: [deployments, deployments/scale]
-  #   resourceNames: [gluetun-gateway]      # SCOPE to the gateway only
-  #   verbs: [get, patch, update]
+  # ---- R-NET-06 (VPN kill-switch, ADR-0015): the fault is a HOST systemd action
+  # (stop/start `vpn-egress-tunnel` on the egress-gateway node), NOT scaling an
+  # in-cluster gluetun Deployment (superseded design). It is driven by a privileged,
+  # hostPID, node-pinned Job (nsenter -t 1 -- systemctl ...). That power comes from
+  # PodSecurity (the test namespace relabeled to enforce=privileged) + the pod's
+  # securityContext, NOT from RBAC — the fault Job pod needs NO Kubernetes API
+  # rights. The runner only needs `jobs` create/delete + `namespaces` patch above.
+  # PREREQUISITE: if a cluster-wide Kyverno disallow-privileged / disallow-host-
+  # namespaces policy is enforced, the `chainsaw-conf-*` test namespaces MUST be in
+  # its exclusion set (documented, audited exception — R-SEC-02).
   #
   # ---- R-STATE-02 (node loss): cordon/drain/uncordon a node  (NOT in WS-TEST scope yet)
   # - apiGroups: [""]