T-0.4 Chainsaw conformance harness + coverage + behavior scaffolds (R-TEST-01..06)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-08-16 00:08:32 -05:00
1 parent a778d923b6
commit 9d8e03892f
@@ -0,0 +1,50 @@
+# =============================================================================
+# L2 BEHAVIORAL SCAFFOLD — Trusted TLS  (R-TLS-01, R-TLS-03)
+# Catalog: docs/14 "Trusted TLS (R-TLS-01/02)"
+#
+# GIVEN any exposed endpoint (including `internal`),
+# WHEN  its certificate is inspected from a probe,
+# THEN  it is valid, non-self-signed, unexpired, chains to a trusted root.
+# (R-TLS-03: issuance also works for internal-only services.)
+# Renewal-before-expiry (R-TLS-02) is a separate time/fault scenario — see the
+# hands-off / cert-renewal coverage; not asserted here.
+#
+# STATUS: scaffold — needs T-2.4 (cert-manager + LE DNS-01 wildcard).
+# =============================================================================
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: trusted-tls
+  labels:
+    conformance.home.k3s/R-TLS-01: "true"
+    conformance.home.k3s/R-TLS-03: "true"
+  annotations:
+    conformance.home.k3s/requirements: "R-TLS-01, R-TLS-03"
+    conformance.home.k3s/layer: "L2"
+    conformance.home.k3s/safety-critical: "false"
+    conformance.home.k3s/intent: >-
+      Exposed endpoints (incl. internal) present a valid, trusted, unexpired cert.
+spec:
+  steps:
+    - name: given-exposed-endpoint
+      try:
+        - script:
+            content: 'echo "TODO(T-2.4/T-2.5): a service with a Gateway TLS listener"'
+    - name: then-cert-is-trusted-and-valid
+      try:
+        - script:
+            # Inspect from an ephemeral probe using the system trust store (no -k):
+            # a self-signed / expired / untrusted cert fails the handshake => rc!=0.
+            content: |
+              set -euo pipefail
+              host="<service>.home.keithjackson.dev"   # TODO: real host
+              echo | openssl s_client -connect "${host}:443" -servername "${host}" \
+                   -verify_return_error 2>/dev/null \
+                | openssl x509 -noout -issuer -enddate -checkend 0 \
+                && echo TLS_VALID
+              # checkend 0 => rc!=0 if already expired; -verify_return_error => trusted chain.
+            check: { ($stdout =~ 'TLS_VALID'): true }
+    - name: then-internal-only-service-also-has-cert
+      try:
+        - script:
+            content: 'echo "TODO(R-TLS-03): repeat against an internal-only host"'