feat(conformance): author R-TLS + R-DNS L2 tests; fix ExternalDNS zone filter
Phase-2 exit tests (were Phase-0 scaffolds), authored against the live platform:
- trusted-tls (R-TLS-01/03): in-cluster probe dials the gateway Service (env-agnostic
via --connect-to) with wildcard SNI and verifies the served cert CHAINS TO THE LE
STAGING ROOT (operator decision A; dev uses LE-staging per ADR-0006). Fixture embeds
the '(STAGING) Pretend Pear X1' root. Probes public + internal-only hostnames (R-TLS-03).
PASSES.
- dns-exposure (R-DNS-02): a LoadBalancer Service with an external-dns hostname; polls
public DNS until ExternalDNS auto-publishes the record; teardown + policy=sync removes it.
ExternalDNS fix (root cause of the DNS test): domain-filter was the platform SUBDOMAIN
home.keithjackson.dev, which filters OUT the actual Cloudflare zone keithjackson.dev
('no hosted zone matching record DNS Name' — record generated but skipped). Add a
DNS_ZONE cluster-var (keithjackson.dev) and set domainFilters to it. policy=sync +
txt-registry still only manage ExternalDNS-owned records (the pre-existing wildcard is
untouched). Resolves the file's WS-NET R-DNS-02 TODO.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed
1 parent
15048f3889
commit
20de78f5eb
5 files changed
+206
-68
No files matched your search
@@ -1,15 +1,21 @@
|
||||
# =============================================================================
|
||||
# L2 BEHAVIORAL SCAFFOLD — Trusted TLS (R-TLS-01, R-TLS-03)
|
||||
# L2 BEHAVIORAL — Trusted TLS (R-TLS-01, R-TLS-03) [RUNNABLE]
|
||||
# Catalog: docs/14 "Trusted TLS (R-TLS-01/02)"
|
||||
# Spec: docs/09 (Gateway API + DNS-01 wildcard), ADR-0006 (LE issuers)
|
||||
#
|
||||
# GIVEN any exposed endpoint (including `internal`),
|
||||
# WHEN its certificate is inspected from a probe,
|
||||
# THEN it is valid, non-self-signed, unexpired, chains to a trusted root.
|
||||
# (R-TLS-03: issuance also works for internal-only services.)
|
||||
# Renewal-before-expiry (R-TLS-02) is a separate time/fault scenario — see the
|
||||
# hands-off / cert-renewal coverage; not asserted here.
|
||||
# GIVEN the shared Gateway terminating TLS with the cert-manager wildcard cert,
|
||||
# WHEN a probe dials it (SNI *.home.keithjackson.dev) and verifies the chain,
|
||||
# THEN the served cert is non-self-signed, unexpired, covers the wildcard SAN,
|
||||
# and CHAINS TO A REAL CA ROOT (R-TLS-01). The wildcard SAN also covers
|
||||
# internal-only hostnames, so internal services get the same trusted cert
|
||||
# (R-TLS-03).
|
||||
#
|
||||
# STATUS: scaffold — needs T-2.4 (cert-manager + LE DNS-01 wildcard).
|
||||
# TRUST MODEL (operator decision "A", DECISIONS-LOG): dev issues from Let's
|
||||
# Encrypt **STAGING** (ADR-0006, to avoid prod rate limits) — a real CA, but not
|
||||
# in the system trust store. So the probe verifies the chain against the LE
|
||||
# STAGING root (fixtures/le-staging-root-ca.yaml, "(STAGING) Pretend Pear X1"),
|
||||
# which is the faithful "chains to a trusted root" check for this environment.
|
||||
# A prod overlay (LE-prod) would verify against the system store instead.
|
||||
# =============================================================================
|
||||
apiVersion: chainsaw.kyverno.io/v1alpha1
|
||||
kind: Test
|
||||
@@ -22,29 +28,67 @@ metadata:
|
||||
conformance.home.k3s/requirements: "R-TLS-01, R-TLS-03"
|
||||
conformance.home.k3s/layer: "L2"
|
||||
conformance.home.k3s/safety-critical: "false"
|
||||
conformance.home.k3s/executable: "true"
|
||||
conformance.home.k3s/intent: >-
|
||||
Exposed endpoints (incl. internal) present a valid, trusted, unexpired cert.
|
||||
The shared Gateway serves a valid, unexpired, non-self-signed wildcard cert
|
||||
that chains to a real CA root (LE-staging in dev); the wildcard SAN covers
|
||||
internal-only hostnames too.
|
||||
spec:
|
||||
steps:
|
||||
- name: given-exposed-endpoint
|
||||
- name: given-le-staging-root-trust-anchor
|
||||
try:
|
||||
- script:
|
||||
content: 'echo "TODO(T-2.4/T-2.5): a service with a Gateway TLS listener"'
|
||||
- name: then-cert-is-trusted-and-valid
|
||||
- apply:
|
||||
file: fixtures/le-staging-root-ca.yaml
|
||||
- name: then-gateway-cert-chains-to-trusted-root
|
||||
try:
|
||||
- script:
|
||||
# Inspect from an ephemeral probe using the system trust store (no -k):
|
||||
# a self-signed / expired / untrusted cert fails the handshake => rc!=0.
|
||||
content: |
|
||||
set -euo pipefail
|
||||
host="<service>.home.keithjackson.dev" # TODO: real host
|
||||
echo | openssl s_client -connect "${host}:443" -servername "${host}" \
|
||||
-verify_return_error 2>/dev/null \
|
||||
| openssl x509 -noout -issuer -enddate -checkend 0 \
|
||||
&& echo TLS_VALID
|
||||
# checkend 0 => rc!=0 if already expired; -verify_return_error => trusted chain.
|
||||
check: { ($stdout =~ 'TLS_VALID'): true }
|
||||
- name: then-internal-only-service-also-has-cert
|
||||
try:
|
||||
- script:
|
||||
content: 'echo "TODO(R-TLS-03): repeat against an internal-only host"'
|
||||
- apply:
|
||||
resource:
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: tls-probe
|
||||
spec:
|
||||
backoffLimit: 4
|
||||
activeDeadlineSeconds: 120
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: ca
|
||||
configMap:
|
||||
name: le-staging-root
|
||||
containers:
|
||||
- name: probe
|
||||
image: curlimages/curl:8.11.1
|
||||
volumeMounts:
|
||||
- name: ca
|
||||
mountPath: /ca
|
||||
readOnly: true
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -eu
|
||||
gw="cilium-gateway-shared.gateway.svc.cluster.local"
|
||||
# Probe TWO wildcard hostnames — one "public", one "internal-only". Both
|
||||
# match *.home.keithjackson.dev, so a clean verify against the LE-staging
|
||||
# root for BOTH proves R-TLS-01 (chains to a real CA root) AND R-TLS-03
|
||||
# (the same trusted wildcard covers internal-only names).
|
||||
# --connect-to sends SNI/Host=$host but DIALS the gateway Service by name
|
||||
# (env-agnostic — no hardcoded VIP). curl (no -f) exits 0 on the gateway's
|
||||
# 404 once TLS+hostname verify; it exits 60 if the chain/hostname fails
|
||||
# (verified empirically), so `set -e` + rc=0 is the assertion. TLS
|
||||
# terminates at the gateway before HTTP routing, so no backend is needed.
|
||||
for host in conformance.home.keithjackson.dev internal-only.home.keithjackson.dev; do
|
||||
curl -sS --cacert /ca/root.pem \
|
||||
--connect-to "${host}:443:${gw}:443" \
|
||||
-o /dev/null "https://${host}/"
|
||||
echo "TLS_TRUSTED ${host}"
|
||||
done
|
||||
echo ALL_TRUSTED
|
||||
- assert:
|
||||
resource:
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata: { name: tls-probe }
|
||||
status: { succeeded: 1 }
|
||||
@@ -0,0 +1,38 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
root.pem: |
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIFmDCCA4CgAwIBAgIQU9C87nMpOIFKYpfvOHFHFDANBgkqhkiG9w0BAQsFADBm
|
||||
MQswCQYDVQQGEwJVUzEzMDEGA1UEChMqKFNUQUdJTkcpIEludGVybmV0IFNlY3Vy
|
||||
aXR5IFJlc2VhcmNoIEdyb3VwMSIwIAYDVQQDExkoU1RBR0lORykgUHJldGVuZCBQ
|
||||
ZWFyIFgxMB4XDTE1MDYwNDExMDQzOFoXDTM1MDYwNDExMDQzOFowZjELMAkGA1UE
|
||||
BhMCVVMxMzAxBgNVBAoTKihTVEFHSU5HKSBJbnRlcm5ldCBTZWN1cml0eSBSZXNl
|
||||
YXJjaCBHcm91cDEiMCAGA1UEAxMZKFNUQUdJTkcpIFByZXRlbmQgUGVhciBYMTCC
|
||||
AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALbagEdDTa1QgGBWSYkyMhsc
|
||||
ZXENOBaVRTMX1hceJENgsL0Ma49D3MilI4KS38mtkmdF6cPWnL++fgehT0FbRHZg
|
||||
jOEr8UAN4jH6omjrbTD++VZneTsMVaGamQmDdFl5g1gYaigkkmx8OiCO68a4QXg4
|
||||
wSyn6iDipKP8utsE+x1E28SA75HOYqpdrk4HGxuULvlr03wZGTIf/oRt2/c+dYmD
|
||||
oaJhge+GOrLAEQByO7+8+vzOwpNAPEx6LW+crEEZ7eBXih6VP19sTGy3yfqK5tPt
|
||||
TdXXCOQMKAp+gCj/VByhmIr+0iNDC540gtvV303WpcbwnkkLYC0Ft2cYUyHtkstO
|
||||
fRcRO+K2cZozoSwVPyB8/J9RpcRK3jgnX9lujfwA/pAbP0J2UPQFxmWFRQnFjaq6
|
||||
rkqbNEBgLy+kFL1NEsRbvFbKrRi5bYy2lNms2NJPZvdNQbT/2dBZKmJqxHkxCuOQ
|
||||
FjhJQNeO+Njm1Z1iATS/3rts2yZlqXKsxQUzN6vNbD8KnXRMEeOXUYvbV4lqfCf8
|
||||
mS14WEbSiMy87GB5S9ucSV1XUrlTG5UGcMSZOBcEUpisRPEmQWUOTWIoDQ5FOia/
|
||||
GI+Ki523r2ruEmbmG37EBSBXdxIdndqrjy+QVAmCebyDx9eVEGOIpn26bW5LKeru
|
||||
mJxa/CFBaKi4bRvmdJRLAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB
|
||||
Af8EBTADAQH/MB0GA1UdDgQWBBS182Xy/rAKkh/7PH3zRKCsYyXDFDANBgkqhkiG
|
||||
9w0BAQsFAAOCAgEAncDZNytDbrrVe68UT6py1lfF2h6Tm2p8ro42i87WWyP2LK8Y
|
||||
nLHC0hvNfWeWmjZQYBQfGC5c7aQRezak+tHLdmrNKHkn5kn+9E9LCjCaEsyIIn2j
|
||||
qdHlAkepu/C3KnNtVx5tW07e5bvIjJScwkCDbP3akWQixPpRFAsnP+ULx7k0aO1x
|
||||
qAeaAhQ2rgo1F58hcflgqKTXnpPM02intVfiVVkX5GXpJjK5EoQtLceyGOrkxlM/
|
||||
sTPq4UrnypmsqSagWV3HcUlYtDinc+nukFk6eR4XkzXBbwKajl0YjztfrCIHOn5Q
|
||||
CJL6TERVDbM/aAPly8kJ1sWGLuvvWYzMYgLzDul//rUF10gEMWaXVZV51KpS9DY/
|
||||
5CunuvCXmEQJHo7kGcViT7sETn6Jz9KOhvYcXkJ7po6d93A/jy4GKPIPnsKKNEmR
|
||||
xUuXY4xRdh45tMJnLTUDdC9FIU0flTeO9/vNpVA8OPU1i14vCz+MU8KX1bV3GXm/
|
||||
fxlB7VBBjX9v5oUep0o/j68R/iDlCOM4VVfRa8gX6T2FU7fNdatvGro7uQzIvWof
|
||||
gN9WUwCbEMBy/YhBSrXycKA8crgGg3x1mIsopn88JKwmMBa68oS7EHM9w7C4y71M
|
||||
7DiA+/9Qdp9RBWJpTS9i/mDnJg1xvo8Xz49mrrgfmcAXTCJqXi24NatI3Oc=
|
||||
-----END CERTIFICATE-----
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: le-staging-root
|
||||
Reference in new issue
Block a user