Wire L1 render conformance tests to the renderer (R-NET-01, R-NET-05/06/07)

Implements the two L1 rendering tests that were failing scaffolds: - egress-class-render (R-NET-05/06/07): renders vpn + internet fixtures, diffs each against a committed golden, asserts the vpn steering label is present on vpn and absent on internet (fail-closed), and that flipping the class changes ONLY the egress path (R-NET-07). This fixes the --requirements R-NET-05 merge gate. - default-deny-baseline-render (R-NET-01): asserts every render carries the namespaced default-deny baseline, shaped deny-all + both directions. Each test carries a pure-offline render-check.sh (renderer + golden diff, no cluster). run.sh runs L1 render checks offline and emits a REAL pass/fail JUnit (docs/14: L1 rendering assertions run in CI without a cluster) instead of skipping L1 with the cluster-gated layers; the chainsaw-test.yaml wrappers invoke the same render-check.sh so an in-cluster run executes the identical assertion. Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-24 22:19:08 -05:00
1 parent 6b2c04ed5c
commit 4a017c590e
@@ -11,7 +11,11 @@
 # the L0 Kyverno gate (T-0.5). Rendering the baseline is necessary but NOT
 # sufficient — enforcement is proven behaviorally at L2 (R-TEST-01).
 #
-# STATUS: scaffold — needs T-0.3 (renderer) + T-2.2 (baseline definition).
+# STATUS: IMPLEMENTED (T-0.3). render-check.sh renders a service and asserts the
+# namespaced default-deny baseline is present + shaped (deny-all, both directions) —
+# a pure offline check (renderer + golden diff, no cluster). conformance/run.sh --layer
+# l1 and ci/l1.sh run it directly; this Chainsaw Test wraps the SAME script so an
+# in-cluster run executes the identical assertion. Rendering != enforcement (proven L2).
 # =============================================================================
 apiVersion: chainsaw.kyverno.io/v1alpha1
 kind: Test
@@ -27,11 +31,10 @@ metadata:
      Rendering any service's namespace yields a default-deny baseline policy.
 spec:
  steps:
-    - name: given-a-rendered-namespace
+    - name: render-and-assert-default-deny
+      description: >-
+        Render a service and assert the namespaced default-deny baseline is present and
+        shaped (deny-all ingress, both Ingress+Egress), matching the golden.
      try:
        - script:
-            content: 'echo "TODO(T-0.3/T-2.2): render a service; capture namespaced policies"'
-    - name: then-render-includes-default-deny
-      try:
-        - assert:
-            file: golden/default-deny-baseline.expected.yaml   # TODO: author golden
+            content: bash ./render-check.sh
@@ -0,0 +1,8 @@
+# L1 fixture: a minimal ServiceDefinition. Any onboarded service — regardless of its
+# dependencies — must render the namespaced default-deny baseline (R-NET-01). This fixture
+# declares NO dependencies, so its render must still carry the deny-all + DNS-only baseline.
+# Validates against schemas/servicedefinition.schema.json.
+name: baseline-demo
+kind: container
+source:
+  image: nginx:1.27
@@ -0,0 +1,103 @@
+---
+# Namespace (trust zone; default-deny + policies apply)
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: baseline-demo
+  labels:
+    homelab.keithjackson.dev/app-namespace: 'true'
+---
+# Default-deny baseline (R-NET-01): deny all, allow only DNS
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: baseline-demo
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress: []
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: UDP
+      port: 53
+    - protocol: TCP
+      port: 53
+---
+# Deployment (R-PLAT-02)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: baseline-demo
+  namespace: baseline-demo
+  labels:
+    app.kubernetes.io/name: baseline-demo
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: baseline-demo
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: baseline-demo
+        homelab.keithjackson.dev/egress-class: internet
+        homelab.keithjackson.dev/auth-mode: none
+    spec:
+      containers:
+      - name: baseline-demo
+        image: nginx:1.27
+---
+# ServiceMonitor (R-OBS-01)
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: baseline-demo
+  namespace: baseline-demo
+  labels:
+    release: kube-prometheus-stack
+    app.kubernetes.io/name: baseline-demo
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: baseline-demo
+  namespaceSelector:
+    matchNames:
+    - baseline-demo
+  endpoints:
+  - port: metrics
+    interval: 30s
+---
+# Flux ImageRepository (R-UPD)
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
+metadata:
+  name: baseline-demo
+  namespace: baseline-demo
+spec:
+  image: nginx
+  interval: 1h0m0s
+---
+# Flux ImagePolicy (R-UPD)
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
+metadata:
+  name: baseline-demo
+  namespace: baseline-demo
+  annotations:
+    homelab.keithjackson.dev/update-channel: stable
+    homelab.keithjackson.dev/auto-rollback: 'true'
+spec:
+  imageRepositoryRef:
+    name: baseline-demo
+  policy:
+    semver:
+      range: '>=0.0.0'
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# =============================================================================
+# L1 render check (offline, no cluster) — default-deny-baseline-render
+# Serves: R-NET-01 (every namespace renders a default-deny baseline). Run by
+# conformance/run.sh --layer l1 and ci/l1.sh. Pure bash + catalog/render.py.
+#
+# GIVEN any onboarded service (this fixture declares NO dependencies),
+# WHEN  its resources are rendered,
+# THEN  (1) the render matches the committed golden byte-for-byte, and
+#       (2) it includes a NetworkPolicy labelled baseline=default-deny that denies
+#           all ingress (ingress: []) and covers BOTH Ingress and Egress — the
+#           render-time partner of the Kyverno L0 gate and the L2 behavioral test.
+# =============================================================================
+set -euo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "${DIR}/../../../.." && pwd)"        # repo root
+RENDER="${ROOT}/catalog/render.py"
+PYTHON="${PYTHON:-python3}"
+LBL="homelab.keithjackson.dev"
+
+tmp="$(mktemp -d)"
+trap 'rm -rf "${tmp}"' EXIT
+
+fail() { echo "RENDER-CHECK FAIL (default-deny-baseline-render): $*" >&2; exit 1; }
+
+"${PYTHON}" "${RENDER}" "${DIR}/fixtures/svcdef.yaml" > "${tmp}/out.yaml"
+
+# (1) golden match.
+diff -u "${DIR}/golden/expected.yaml" "${tmp}/out.yaml" || fail "render drifted from golden"
+
+# (2) the baseline is present and shaped as deny-all + both directions.
+grep -q "${LBL}/baseline: default-deny" "${tmp}/out.yaml" \
+  || fail "render is missing the default-deny baseline NetworkPolicy (R-NET-01)"
+
+# Structural assertion via the renderer's own parse (deterministic, no cluster):
+# find the default-deny NetworkPolicy and assert its shape.
+"${PYTHON}" - "${tmp}/out.yaml" <<'PY' || fail "default-deny baseline is malformed (R-NET-01)"
+import sys, yaml
+docs = [d for d in yaml.safe_load_all(open(sys.argv[1])) if d]
+np = [d for d in docs
+      if d.get("kind") == "NetworkPolicy"
+      and d.get("metadata", {}).get("labels", {}).get(
+          "homelab.keithjackson.dev/baseline") == "default-deny"]
+assert len(np) == 1, f"expected exactly one default-deny baseline, got {len(np)}"
+spec = np[0]["spec"]
+assert spec.get("ingress") == [], "baseline must deny ALL ingress (ingress: [])"
+assert set(spec.get("policyTypes", [])) == {"Ingress", "Egress"}, \
+    "baseline must cover BOTH Ingress and Egress"
+PY
+
+echo "render-check OK: default-deny-baseline-render (R-NET-01)"