feat(conformance): author R-TLS + R-DNS L2 tests; fix ExternalDNS zone filter
Phase-2 exit tests (were Phase-0 scaffolds), authored against the live platform:
- trusted-tls (R-TLS-01/03): in-cluster probe dials the gateway Service (env-agnostic
via --connect-to) with wildcard SNI and verifies the served cert CHAINS TO THE LE
STAGING ROOT (operator decision A; dev uses LE-staging per ADR-0006). Fixture embeds
the '(STAGING) Pretend Pear X1' root. Probes public + internal-only hostnames (R-TLS-03).
PASSES.
- dns-exposure (R-DNS-02): a LoadBalancer Service with an external-dns hostname; polls
public DNS until ExternalDNS auto-publishes the record; teardown + policy=sync removes it.
ExternalDNS fix (root cause of the DNS test): domain-filter was the platform SUBDOMAIN
home.keithjackson.dev, which filters OUT the actual Cloudflare zone keithjackson.dev
('no hosted zone matching record DNS Name' — record generated but skipped). Add a
DNS_ZONE cluster-var (keithjackson.dev) and set domainFilters to it. policy=sync +
txt-registry still only manage ExternalDNS-owned records (the pre-existing wildcard is
untouched). Resolves the file's WS-NET R-DNS-02 TODO.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed
1 parent
15048f3889
commit
20de78f5eb
5 files changed
+206
-68
No files matched your search
@@ -1,53 +1,101 @@
|
||||
# =============================================================================
|
||||
# L2 BEHAVIORAL SCAFFOLD — DNS / exposure (R-DNS-01, R-DNS-02, R-DNS-03)
|
||||
# L2 BEHAVIORAL — DNS auto-record / exposure (R-DNS-02) [RUNNABLE]
|
||||
# Catalog: docs/14 "DNS/exposure (R-DNS-*)"
|
||||
# Spec: docs/09 (ExternalDNS auto-manages records; split-horizon foundation)
|
||||
#
|
||||
# GIVEN a service,
|
||||
# WHEN it is resolved,
|
||||
# THEN the record exists (auto-managed) and internal clients hit the internal
|
||||
# Gateway; an `internal` service is unreachable publicly while a `public`
|
||||
# service is reachable + TLS-valid.
|
||||
# GIVEN a LoadBalancer Service annotated with an external-dns hostname,
|
||||
# WHEN ExternalDNS reconciles (source=service, provider=cloudflare, policy=sync),
|
||||
# THEN a PUBLIC DNS record for that hostname is auto-created, pointing at the
|
||||
# Service's Cilium-assigned LB IP (R-DNS-02). The record resolves to the
|
||||
# cluster LB IP (10.73.0.240-.250), i.e. clients reach the cluster endpoint.
|
||||
#
|
||||
# STATUS: scaffold — needs T-2.5 (ExternalDNS + Gateway + split-horizon PiHole).
|
||||
# CLEANUP: chainsaw deletes the per-test namespace (Service included) at teardown;
|
||||
# ExternalDNS policy=sync then REMOVES the record from Cloudflare on its next pass.
|
||||
# This test creates a real record in the live keithjackson.dev zone (operator-approved).
|
||||
#
|
||||
# SCOPE: asserts R-DNS-02 (auto-managed record appears) concretely. R-DNS-01/03
|
||||
# (split-horizon internal-vs-external resolution) need the internal resolver and
|
||||
# are covered separately.
|
||||
# =============================================================================
|
||||
apiVersion: chainsaw.kyverno.io/v1alpha1
|
||||
kind: Test
|
||||
metadata:
|
||||
name: dns-exposure
|
||||
labels:
|
||||
conformance.home.k3s/R-DNS-01: "true"
|
||||
conformance.home.k3s/R-DNS-02: "true"
|
||||
conformance.home.k3s/R-DNS-03: "true"
|
||||
annotations:
|
||||
conformance.home.k3s/requirements: "R-DNS-01, R-DNS-02, R-DNS-03"
|
||||
conformance.home.k3s/requirements: "R-DNS-02"
|
||||
conformance.home.k3s/layer: "L2"
|
||||
conformance.home.k3s/safety-critical: "false"
|
||||
conformance.home.k3s/executable: "true"
|
||||
conformance.home.k3s/intent: >-
|
||||
Record auto-appears; internal clients resolve to the internal Gateway;
|
||||
internal is not public, public is reachable + TLS-valid.
|
||||
A LoadBalancer Service annotated with an external-dns hostname gets a public
|
||||
DNS record auto-created by ExternalDNS (Cloudflare), resolving to its LB IP.
|
||||
spec:
|
||||
# ExternalDNS reconcile + Cloudflare propagation can take a couple of minutes;
|
||||
# widen the assert/exec windows for this test only.
|
||||
timeouts:
|
||||
apply: 90s
|
||||
assert: 5m
|
||||
exec: 6m
|
||||
steps:
|
||||
- name: given-a-declared-service
|
||||
- name: given-a-service-requesting-a-dns-name
|
||||
try:
|
||||
- script:
|
||||
content: 'echo "TODO(T-2.5): onboard a service via ServiceDefinition"'
|
||||
- name: then-record-exists-auto-managed
|
||||
- apply:
|
||||
resource:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: dns-probe-svc
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: conformance-dns.home.keithjackson.dev
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
# No real backend needed — Cilium LB-IPAM assigns a VIP regardless, and
|
||||
# ExternalDNS creates the record from the Service's LB IP + annotation.
|
||||
selector:
|
||||
app: dns-probe-no-such-backend
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 80
|
||||
- name: then-externaldns-creates-the-public-record
|
||||
try:
|
||||
- apply:
|
||||
resource:
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: dns-verify
|
||||
spec:
|
||||
backoffLimit: 2
|
||||
activeDeadlineSeconds: 330
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: probe
|
||||
image: busybox:1.36.1
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -u
|
||||
host="conformance-dns.home.keithjackson.dev"
|
||||
# Poll PUBLIC DNS (1.1.1.1) until the auto-created A record appears and
|
||||
# points into the cluster LB range 10.73.0.24x. Proves ExternalDNS created it.
|
||||
for i in $(seq 1 28); do
|
||||
ip="$(nslookup "$host" 1.1.1.1 2>/dev/null | grep -oE '10\.73\.0\.[0-9]+' | head -1)"
|
||||
if [ -n "$ip" ]; then echo "RECORD_FOUND $host -> $ip"; exit 0; fi
|
||||
echo "poll $i: record not yet published"; sleep 10
|
||||
done
|
||||
echo "FAIL: ExternalDNS did not publish the record within timeout"; exit 1
|
||||
- assert:
|
||||
resource:
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata: { name: dns-verify }
|
||||
status: { succeeded: 1 }
|
||||
finally:
|
||||
- script:
|
||||
# R-DNS-01/02: the <service>.home.keithjackson.dev record appears with
|
||||
# no manual step (ExternalDNS from declared intent).
|
||||
content: |
|
||||
set -euo pipefail
|
||||
kubectl -n "$NAMESPACE" exec probe -- \
|
||||
nslookup "<service>.home.keithjackson.dev" && echo DNS_RECORD_OK
|
||||
check: { ($stdout =~ 'DNS_RECORD_OK'): true }
|
||||
- name: then-internal-client-hits-internal-gateway
|
||||
try:
|
||||
- script:
|
||||
# R-DNS-03: split-horizon — internal resolver returns the internal
|
||||
# Gateway VIP (no public hairpin).
|
||||
content: 'echo "TODO(T-2.5): assert resolved IP == internal Gateway VIP"'
|
||||
- name: then-internal-unreachable-publicly-public-reachable
|
||||
try:
|
||||
- script:
|
||||
content: 'echo "TODO: assert internal not public; public reachable + TLS-valid"'
|
||||
content: 'echo "teardown: chainsaw deletes the namespace/Service; ExternalDNS policy=sync removes the Cloudflare record"'
|
||||
Reference in new issue
Block a user