Wire L1 render conformance tests to the renderer (R-NET-01, R-NET-05/06/07)

Implements the two L1 rendering tests that were failing scaffolds: - egress-class-render (R-NET-05/06/07): renders vpn + internet fixtures, diffs each against a committed golden, asserts the vpn steering label is present on vpn and absent on internet (fail-closed), and that flipping the class changes ONLY the egress path (R-NET-07). This fixes the --requirements R-NET-05 merge gate. - default-deny-baseline-render (R-NET-01): asserts every render carries the namespaced default-deny baseline, shaped deny-all + both directions. Each test carries a pure-offline render-check.sh (renderer + golden diff, no cluster). run.sh runs L1 render checks offline and emits a REAL pass/fail JUnit (docs/14: L1 rendering assertions run in CI without a cluster) instead of skipping L1 with the cluster-gated layers; the chainsaw-test.yaml wrappers invoke the same render-check.sh so an in-cluster run executes the identical assertion. Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-24 22:19:08 -05:00
1 parent 6b2c04ed5c
commit 4a017c590e
@@ -0,0 +1,103 @@
+---
+# Namespace (trust zone; default-deny + policies apply)
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: baseline-demo
+  labels:
+    homelab.keithjackson.dev/app-namespace: 'true'
+---
+# Default-deny baseline (R-NET-01): deny all, allow only DNS
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: baseline-demo
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress: []
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: UDP
+      port: 53
+    - protocol: TCP
+      port: 53
+---
+# Deployment (R-PLAT-02)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: baseline-demo
+  namespace: baseline-demo
+  labels:
+    app.kubernetes.io/name: baseline-demo
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: baseline-demo
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: baseline-demo
+        homelab.keithjackson.dev/egress-class: internet
+        homelab.keithjackson.dev/auth-mode: none
+    spec:
+      containers:
+      - name: baseline-demo
+        image: nginx:1.27
+---
+# ServiceMonitor (R-OBS-01)
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: baseline-demo
+  namespace: baseline-demo
+  labels:
+    release: kube-prometheus-stack
+    app.kubernetes.io/name: baseline-demo
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: baseline-demo
+  namespaceSelector:
+    matchNames:
+    - baseline-demo
+  endpoints:
+  - port: metrics
+    interval: 30s
+---
+# Flux ImageRepository (R-UPD)
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
+metadata:
+  name: baseline-demo
+  namespace: baseline-demo
+spec:
+  image: nginx
+  interval: 1h0m0s
+---
+# Flux ImagePolicy (R-UPD)
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
+metadata:
+  name: baseline-demo
+  namespace: baseline-demo
+  annotations:
+    homelab.keithjackson.dev/update-channel: stable
+    homelab.keithjackson.dev/auto-rollback: 'true'
+spec:
+  imageRepositoryRef:
+    name: baseline-demo
+  policy:
+    semver:
+      range: '>=0.0.0'