Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Autonomous session: Phase-2 platform authoring + Flux bootstrap progress

Browse Source 
Author-only Phase-2 components (platform suspended; cluster untouched):
- platform/longhorn: 3-replica SC + bulk external-mount indirection (R-STATE)
- platform/monitoring: kube-prometheus-stack + Loki + Alloy (dev-trimmed) + 8 alert rules (R-OBS)
- platform/cilium: parity fix (k8sServiceHost=10.73.0.11 + masquerade) safe to adopt Phase 2
- conformance: partial L2 tests (worker hit session limit; incomplete — see DECISIONS-LOG K2)
- bootstrap/gitea: fix rootless-podman perms (host bind-mount -> named volume)

Flux installed on the cluster; host Gitea up + repo pushed; GitRepository BLOCKED by
host firewalld (VM->10.73.0.1:3000) — needs one operator sudo command (DECISIONS-LOG).
Known issue K1: cluster-vars substitution-var case mismatch (fix before un-suspend).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-16 14:32:47 -05:00
1 parent 397f29e99a
commit cc89b4b830
19 files changed
+1567 -221
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

conformance/run.sh
+10 -1
View File
@@ -9,6 +9,7 @@
# ./run.sh # full suite; skips L1/L2/L3 if no cluster
# ./run.sh --requirements R-NET-01,R-NET-06 # merge-gate subset (tagged)
# ./run.sh --layer l2 # one layer
# ./run.sh --requirements R-NET-01,R-NET-02 --layer l2 # intersect: tagged AND in layer
# ./run.sh --coverage-only # regenerate coverage report only (no cluster)
# ./run.sh --lint # structural-validate test defs (no cluster)
# ./run.sh --strict-coverage # hygiene gate: fail on tag/annotation drift
@@ -108,7 +109,15 @@ lint_tests() {
# --- Select which test directories Chainsaw should run --------------------------------
select_dirs() {
if [ -n "${REQS}" ]; then
# --requirements AND --layer together => intersection (tests carrying the tag
# AND living in that layer subtree). Either alone keeps its prior meaning, so
# this is backward compatible (LAYER defaults to "all"). Both helpers emit
# sorted, de-duplicated dirs, so `comm -12` yields the intersection.
if [ -n "${REQS}" ] && [ "${LAYER}" != all ]; then
comm -12 \
<(conf_dirs_for_requirements "${REQS}") \
<(conf_dirs_for_layer "${LAYER}")
elif [ -n "${REQS}" ]; then
conf_dirs_for_requirements "${REQS}"
else
conf_dirs_for_layer "${LAYER}"
conformance/tests/l2-behavioral/default-deny/chainsaw-test.yaml
+115 -58
View File
@@ -1,23 +1,26 @@
# =============================================================================
# L2 BEHAVIORAL SCAFFOLD — Default-deny east-west (R-NET-01)
# L2 BEHAVIORAL — Default-deny east-west (R-NET-01) [RUNNABLE]
# Catalog: docs/14-testing-and-conformance.md "Default-deny (R-NET-01)"
# Spec: docs/03-networking-isolation-and-egress.md "Default-deny baseline"
#
# EXEMPLAR: this file is the reference for the tagging convention and step
# style. Other scaffolds follow the same shape (see tests/README.md).
#
# GIVEN a fresh workload in a namespace with no allow rules,
# GIVEN a fresh workload in a namespace with the default-deny baseline applied,
# WHEN it attempts any in-cluster connection except DNS,
# THEN the connection FAILS (fail-closed); DNS still succeeds.
#
# This asserts observable BEHAVIOR (a probe cannot connect), not the mere
# existence of a NetworkPolicy object (R-TEST-01). Safety-relevant: the
# fail-closed direction is also exercised under fault-injection at L3
# (kill-switch / drift), but the baseline deny is a behavioral must-pass.
# This asserts observable BEHAVIOR (a probe Job cannot connect) via ephemeral
# probe pods, not the mere existence of a policy object (R-TEST-01).
#
# STATUS: scaffold — cannot run until Phase 2 delivers the default-deny
# baseline (T-2.2). Chainsaw auto-creates/cleans the namespace (hermetic).
# TODOs mark fixtures that land as later phases deliver.
# RUNNABLE ON THE BASE CLUSTER: the platform-wide default-deny baseline (T-2.2)
# is not yet applied cluster-wide, so this test applies an equivalent baseline
# as its OWN hermetic fixture in the per-test namespace. The fixture is a
# standard Kubernetes NetworkPolicy (Cilium enforces it) — portable and
# version-agnostic; the platform's baseline will be the CiliumNetworkPolicy
# equivalent, but the asserted BEHAVIOR (DNS-only egress) is identical, which
# is what R-TEST-01 requires us to prove. Chainsaw auto-creates/cleans the
# namespace (hermetic); the probe Jobs are ephemeral and self-cleaned with it.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
@@ -30,69 +33,123 @@ metadata:
conformance.home.k3s/requirements: "R-NET-01"
conformance.home.k3s/layer: "L2"
conformance.home.k3s/safety-critical: "false"
# executable => this test runs real behavior against a cluster (not a scaffold).
conformance.home.k3s/executable: "true"
conformance.home.k3s/intent: >-
Given a bare workload with no allow rules, only DNS egress succeeds;
every other in-cluster connection is denied.
Given a bare workload in a namespace with the default-deny baseline, only
DNS egress succeeds; every other in-cluster connection is denied.
spec:
steps:
# -- GIVEN: a fresh, unprivileged probe workload with zero allow rules. The
# per-test namespace inherits the platform default-deny baseline (T-2.2).
- name: given-bare-probe-workload
# -- GIVEN: apply the default-deny baseline to the per-test namespace. Deny all
# ingress + egress for every pod; allow ONLY DNS egress to the in-cluster
# resolver. This is the hermetic stand-in for the platform baseline (T-2.2).
- name: given-default-deny-baseline
try:
- apply:
# TODO(T-2.2): once the namespaced default-deny CiliumNetworkPolicy
# baseline exists, assert it is present AND that the probe below is
# actually blocked (existence != enforcement, R-TEST-01).
resource:
apiVersion: v1
kind: Pod
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: probe
labels: { app: conformance-probe }
name: default-deny-baseline
spec:
restartPolicy: Never
containers:
- name: probe
image: ghcr.io/kyverno/kyvernopre:latest # TODO: pin a curl/nc probe image
command: ["sleep", "3600"]
- assert:
resource:
apiVersion: v1
kind: Pod
metadata: { name: probe }
status: { phase: Running }
podSelector: {}
policyTypes: [Ingress, Egress]
# no ingress rules => deny all ingress
ingress: []
# only DNS egress to kube-dns (CoreDNS) in kube-system
egress:
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
# -- THEN(DNS allowed): DNS egress MUST succeed even under default-deny.
# -- THEN(DNS allowed): DNS egress MUST succeed even under default-deny. An
# ephemeral Job resolves an in-cluster name; we assert the Job SUCCEEDS.
# (Chainsaw polls the Job status within the assert timeout — bounded, no sleeps.)
- name: then-dns-succeeds
try:
- script:
# TODO(T-2.2): resolve an in-cluster name via kube-dns; expect rc=0.
content: |
set -euo pipefail
kubectl -n "$NAMESPACE" exec probe -- \
sh -c 'nslookup kubernetes.default.svc.cluster.local' && echo DNS_OK
check:
# bounded, deterministic: no sleeps; chainsaw retries within timeout.
($stdout =~ 'DNS_OK'): true
- apply:
resource:
apiVersion: batch/v1
kind: Job
metadata:
name: dns-probe
spec:
backoffLimit: 4
activeDeadlineSeconds: 120
template:
metadata:
labels: { app: conformance-probe }
spec:
restartPolicy: Never
containers:
- name: probe
image: busybox:1.36.1
command:
- sh
- -c
- |
set -eu
# DNS is the one egress the baseline permits.
nslookup kubernetes.default.svc.cluster.local
echo DNS_OK
- assert:
resource:
apiVersion: batch/v1
kind: Job
metadata: { name: dns-probe }
status: { succeeded: 1 }
# -- THEN(everything else denied): a non-DNS in-cluster connection MUST fail.
# -- THEN(everything else denied): a non-DNS in-cluster connection MUST fail
# closed. The Job attempts to reach the kube-apiserver ClusterIP (always
# present) on 443; the probe EXITS 0 only when that connection is BLOCKED,
# so a green Job proves the deny. A leak (connection succeeds) fails the Job.
- name: then-nondns-denied
try:
- script:
# TODO(T-2.2 / T-2.6): target an in-cluster service (e.g. Plex/Gateway)
# on a real port; expect the connection to FAIL closed (non-zero / timeout).
content: |
set -euo pipefail
if kubectl -n "$NAMESPACE" exec probe -- \
sh -c 'nc -z -w 3 <in-cluster-service> 80'; then
echo "LEAK: connection succeeded under default-deny" >&2
exit 1
fi
echo DENIED_OK
check:
($stdout =~ 'DENIED_OK'): true
# -- finally: chainsaw deletes the namespace + probe automatically; this block
# is the explicit hook for any out-of-namespace fixtures (none here).
- apply:
resource:
apiVersion: batch/v1
kind: Job
metadata:
name: block-probe
spec:
backoffLimit: 4
activeDeadlineSeconds: 120
template:
metadata:
labels: { app: conformance-probe }
spec:
restartPolicy: Never
containers:
- name: probe
image: busybox:1.36.1
command:
- sh
- -c
- |
set -u
# DNS resolves (allowed); the TCP connect must be dropped.
if nc -w 4 kubernetes.default.svc.cluster.local 443 </dev/null 2>/dev/null; then
echo "LEAK: reached kube-apiserver under default-deny" 1>&2
exit 1
fi
echo DENIED_OK
- assert:
resource:
apiVersion: batch/v1
kind: Job
metadata: { name: block-probe }
status: { succeeded: 1 }
# -- chainsaw deletes the namespace (policy + probe Jobs) automatically; this
# block is the explicit hook for any out-of-namespace fixtures (none here).
finally:
- script:
content: 'echo "cleanup handled by chainsaw namespace teardown"'
conformance/tests/l2-behavioral/deny-undeclared/chainsaw-test.yaml
+145 -23
View File
@@ -1,12 +1,20 @@
# =============================================================================
# L2 BEHAVIORAL SCAFFOLD — Explicit allow / deny-undeclared (R-NET-02)
# L2 BEHAVIORAL — Explicit allow / deny-undeclared (R-NET-02) [RUNNABLE]
# Catalog: docs/14 "Explicit allow / deny-undeclared (R-NET-02)"
# Spec: docs/03-networking-isolation-and-egress.md "Explicit allow rules"
#
# GIVEN a service with declared `dependencies`,
# WHEN the source reaches a DECLARED dest port -> THEN it succeeds;
# WHEN the source reaches an UNDECLARED dest -> THEN it fails (negative test).
# GIVEN a namespace with default-deny + ONE explicit allow (source -> declared-dest:8080),
# WHEN the source reaches the DECLARED dest port -> THEN it succeeds;
# WHEN the source reaches an UNDECLARED port (9090) -> THEN it fails;
# WHEN the source reaches an UNDECLARED dest (other) -> THEN it fails.
#
# STATUS: scaffold — needs T-2.3 (render dependencies -> CiliumNetworkPolicy).
# The destinations LISTEN on every probed port, so a block is caused by POLICY,
# not by a missing listener — this asserts BEHAVIOR, not object existence (R-TEST-01).
#
# RUNNABLE ON THE BASE CLUSTER: the fixture supplies the default-deny baseline and
# the single allow (fixtures/source-and-dests.yaml); Cilium enforces the standard
# NetworkPolicies. Probes are ephemeral Jobs labeled app=source so the allow/deny
# rules apply to them; chainsaw namespace teardown cleans everything.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
@@ -18,31 +26,145 @@ metadata:
conformance.home.k3s/requirements: "R-NET-02"
conformance.home.k3s/layer: "L2"
conformance.home.k3s/safety-critical: "false"
conformance.home.k3s/executable: "true"
conformance.home.k3s/intent: >-
A declared dependency connects; an undeclared destination is blocked.
A declared dependency (source->declared-dest:8080) connects; an undeclared
port and an undeclared destination are both blocked by policy.
spec:
steps:
# -- GIVEN: baseline + one explicit allow + two live destinations. Wait until
# both destinations are Ready so a later block is unambiguously policy-caused.
- name: given-source-with-declared-dependency
try:
- apply:
# TODO(T-2.3): apply a ServiceDefinition/rendered policy where `source`
# declares dependency on `dest:declared-port`; deploy source + two dests.
file: fixtures/source-and-dests.yaml # TODO: author fixtures
file: fixtures/source-and-dests.yaml
- assert:
resource:
apiVersion: v1
kind: Pod
metadata: { name: declared-dest }
status:
conditions:
- type: Ready
status: "True"
- assert:
resource:
apiVersion: v1
kind: Pod
metadata: { name: other-dest }
status:
conditions:
- type: Ready
status: "True"
# -- THEN(declared succeeds): source -> declared-dest:8080 connects. Green Job = allowed.
- name: then-declared-succeeds
try:
- script:
content: |
set -euo pipefail
kubectl -n "$NAMESPACE" exec source -- nc -z -w 3 declared-dest 80 \
&& echo ALLOW_OK
check: { ($stdout =~ 'ALLOW_OK'): true }
- name: then-undeclared-denied
- apply:
resource:
apiVersion: batch/v1
kind: Job
metadata:
name: probe-allowed
spec:
backoffLimit: 4
activeDeadlineSeconds: 120
template:
metadata:
labels: { app: source }
spec:
restartPolicy: Never
containers:
- name: probe
image: busybox:1.36.1
command:
- sh
- -c
- |
set -eu
nc -w 5 declared-dest 8080 </dev/null
echo ALLOW_OK
- assert:
resource:
apiVersion: batch/v1
kind: Job
metadata: { name: probe-allowed }
status: { succeeded: 1 }
# -- THEN(undeclared PORT denied): source -> declared-dest:9090 is blocked.
# The Job EXITS 0 only when the connection is BLOCKED (green Job = deny).
- name: then-undeclared-port-denied
try:
- apply:
resource:
apiVersion: batch/v1
kind: Job
metadata:
name: probe-undeclared-port
spec:
backoffLimit: 4
activeDeadlineSeconds: 120
template:
metadata:
labels: { app: source }
spec:
restartPolicy: Never
containers:
- name: probe
image: busybox:1.36.1
command:
- sh
- -c
- |
set -u
if nc -w 5 declared-dest 9090 </dev/null 2>/dev/null; then
echo "LEAK: undeclared port 9090 reachable" 1>&2
exit 1
fi
echo DENY_PORT_OK
- assert:
resource:
apiVersion: batch/v1
kind: Job
metadata: { name: probe-undeclared-port }
status: { succeeded: 1 }
# -- THEN(undeclared DEST denied): source -> other-dest:8080 is blocked.
- name: then-undeclared-dest-denied
try:
- apply:
resource:
apiVersion: batch/v1
kind: Job
metadata:
name: probe-undeclared-dest
spec:
backoffLimit: 4
activeDeadlineSeconds: 120
template:
metadata:
labels: { app: source }
spec:
restartPolicy: Never
containers:
- name: probe
image: busybox:1.36.1
command:
- sh
- -c
- |
set -u
if nc -w 5 other-dest 8080 </dev/null 2>/dev/null; then
echo "LEAK: undeclared destination reachable" 1>&2
exit 1
fi
echo DENY_DEST_OK
- assert:
resource:
apiVersion: batch/v1
kind: Job
metadata: { name: probe-undeclared-dest }
status: { succeeded: 1 }
finally:
- script:
content: |
set -euo pipefail
if kubectl -n "$NAMESPACE" exec source -- nc -z -w 3 undeclared-dest 80; then
echo "LEAK: undeclared destination reachable" >&2; exit 1
fi
echo DENY_OK
check: { ($stdout =~ 'DENY_OK'): true }
content: 'echo "cleanup handled by chainsaw namespace teardown"'
conformance/tests/l2-behavioral/deny-undeclared/fixtures/source-and-dests.yaml
+141
View File
@@ -0,0 +1,141 @@
# =============================================================================
# Fixtures for the deny-undeclared behavior test (R-NET-02).
# Applied into the per-test namespace chainsaw creates (hermetic, self-cleaned).
#
# Models: a namespace default-deny baseline + ONE explicit declared dependency
# source(app=source) --> declared-dest : tcp/8080
# Everything else (declared-dest:9090, other-dest:8080) is UNDECLARED and must
# be blocked purely by policy. The destinations LISTEN on those ports, so a
# blocked probe proves policy enforcement, not a missing listener.
#
# Standard Kubernetes NetworkPolicy is used (Cilium enforces it) for portability;
# the platform will render CiliumNetworkPolicies from catalog `dependencies`
# (T-2.3), but the asserted BEHAVIOR is identical (R-TEST-01).
# =============================================================================
---
# --- Default-deny baseline: deny all ingress+egress, allow only DNS egress. -----------
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-baseline
spec:
podSelector: {}
policyTypes: [Ingress, Egress]
ingress: []
egress:
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
---
# --- The ONE explicit allow (a declared dependency): source --> declared-dest tcp/8080.
# Expressed as the two matching halves a real rendered dependency produces:
# egress permit on the source, ingress permit on the destination.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-source-to-declared-8080-egress
spec:
podSelector:
matchLabels: { app: source }
policyTypes: [Egress]
egress:
- to:
- podSelector:
matchLabels: { app: declared-dest }
ports:
- protocol: TCP
port: 8080
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-source-to-declared-8080-ingress
spec:
podSelector:
matchLabels: { app: declared-dest }
policyTypes: [Ingress]
ingress:
- from:
- podSelector:
matchLabels: { app: source }
ports:
- protocol: TCP
port: 8080
---
# --- declared-dest: LISTENS on BOTH 8080 (declared) and 9090 (undeclared port). --------
# Two agnhost netexec containers, each an HTTP listener; a TCP connect on
# either port reaches a live socket, so a block is caused only by policy.
apiVersion: v1
kind: Pod
metadata:
name: declared-dest
labels: { app: declared-dest }
spec:
containers:
- name: dest-8080
image: registry.k8s.io/e2e-test-images/agnhost:2.47
args: ["netexec", "--http-port=8080"]
ports:
- containerPort: 8080
readinessProbe:
tcpSocket: { port: 8080 }
periodSeconds: 2
- name: dest-9090
image: registry.k8s.io/e2e-test-images/agnhost:2.47
args: ["netexec", "--http-port=9090"]
ports:
- containerPort: 9090
readinessProbe:
tcpSocket: { port: 9090 }
periodSeconds: 2
---
apiVersion: v1
kind: Service
metadata:
name: declared-dest
spec:
selector: { app: declared-dest }
ports:
- name: p8080
port: 8080
targetPort: 8080
- name: p9090
port: 9090
targetPort: 9090
---
# --- other-dest: an UNDECLARED destination. Listens on 8080 but no allow reaches it. ---
apiVersion: v1
kind: Pod
metadata:
name: other-dest
labels: { app: other-dest }
spec:
containers:
- name: dest-8080
image: registry.k8s.io/e2e-test-images/agnhost:2.47
args: ["netexec", "--http-port=8080"]
ports:
- containerPort: 8080
readinessProbe:
tcpSocket: { port: 8080 }
periodSeconds: 2
---
apiVersion: v1
kind: Service
metadata:
name: other-dest
spec:
selector: { app: other-dest }
ports:
- name: p8080
port: 8080
targetPort: 8080
conformance/tests/l3-fault-injection/data-survival/chainsaw-test.yaml
+88 -31
View File
@@ -1,17 +1,21 @@
# =============================================================================
# L3 FAULT-INJECTION SCAFFOLD — Data survival on rebuild (R-STATE-01)
# *SAFETY-CRITICAL*
# L3 FAULT-INJECTION — Data survival on rebuild (R-STATE-01) [RUNNABLE / self-skips]
# *SAFETY-CRITICAL*
# Catalog: docs/14 "Data survival (R-STATE-01, L3)"
# Spec: docs/04-storage-and-state.md
#
# GIVEN a stateful service with written data (PVC on longhorn),
# WHEN the workload is DESTROYED entirely and re-applied from git,
# GIVEN a stateful workload with written data on a longhorn-backed PVC,
# WHEN the workload is DESTROYED entirely and a fresh one re-bound to the PVC,
# THEN the data is intact.
#
# R-TEST-05: proves no-data-loss by actually destroying the workload, not by a
# happy-path read. Applies to PaaS pods AND `kind: vm` disks (shared with
# R-PLAT-03 rebuild).
# R-TEST-05: proves no-data-loss by actually destroying the workload (not a
# happy-path read). The PVC is kept; the pod is deleted and rebuilt.
#
# STATUS: scaffold — needs T-2.1 (Longhorn StorageClass) + T-1.5 rebuild path.
# RUNNABLE / SELF-SKIPPING: Longhorn (T-2.1) is not on the base cluster yet.
# This test SKIPS CLEANLY (green) when no `longhorn` StorageClass exists, and
# runs the full destroy/rebuild survival check the moment one does — no edit
# needed. Hermetic: PVC + pods live in the chainsaw per-test namespace and are
# torn down with it.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
@@ -23,33 +27,86 @@ metadata:
conformance.home.k3s/requirements: "R-STATE-01"
conformance.home.k3s/layer: "L3"
conformance.home.k3s/safety-critical: "true"
# executable => runs against a cluster; self-skips (green) until longhorn exists.
conformance.home.k3s/executable: "true"
conformance.home.k3s/intent: >-
Destroy the workload entirely and re-apply from git; written data survives.
Destroy the workload entirely and re-bind a fresh one to the same longhorn
PVC; written data survives. Skips cleanly until a longhorn StorageClass exists.
spec:
steps:
- name: given-stateful-workload-with-written-data
try:
- apply:
file: fixtures/stateful-app.yaml # TODO(T-2.1): PVC on longhorn + writer
- script:
content: |
set -euo pipefail
kubectl -n "$NAMESPACE" exec app -- \
sh -c 'echo conformance-canary-$(date +%s) > /data/canary && sync'
kubectl -n "$NAMESPACE" exec app -- cat /data/canary
- name: when-destroy-workload-entirely
try:
# FAULT INJECTION: delete the workload (NOT the PVC) — simulate rebuild.
- script:
content: |
set -euo pipefail
echo "TODO(T-1.5): delete Deployment/pod entirely; keep PVC; re-apply from git"
- name: then-data-is-intact-after-reapply
- name: data-survives-destroy-and-rebuild
try:
- script:
content: |
set -euo pipefail
val=$(kubectl -n "$NAMESPACE" exec app -- cat /data/canary)
echo "recovered=$val"
case "$val" in conformance-canary-*) echo DATA_SURVIVED_OK ;; *) exit 1 ;; esac
check: { ($stdout =~ 'DATA_SURVIVED_OK'): true }
NS="$NAMESPACE"
# -- Gate: skip cleanly (green) if the longhorn tier is not present yet. --
if ! kubectl get storageclass longhorn >/dev/null 2>&1; then
echo "SKIP: 'longhorn' StorageClass absent — data-survival not applicable on this cluster yet"
echo DATA_SURVIVAL_SKIPPED_OK
exit 0
fi
CANARY="conformance-canary-$(date +%s%N)"
# -- GIVEN: a PVC on longhorn + a writer pod that writes the canary. --
kubectl -n "$NS" apply -f - <<EOF
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: survivor
spec:
accessModes: [ReadWriteOnce]
storageClassName: longhorn
resources:
requests:
storage: 1Gi
EOF
apply_pod() {
kubectl -n "$NS" apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
name: $1
spec:
restartPolicy: Never
containers:
- name: app
image: busybox:1.36.1
command: ["sh", "-c", "sleep 3600"]
volumeMounts:
- name: data
mountPath: /data
volumes:
- name: data
persistentVolumeClaim:
claimName: survivor
EOF
}
apply_pod writer
kubectl -n "$NS" wait --for=condition=Ready pod/writer --timeout=180s
printf '%s' "$CANARY" | kubectl -n "$NS" exec -i writer -- sh -c 'cat > /data/canary && sync'
echo "wrote canary: $(kubectl -n "$NS" exec writer -- cat /data/canary)"
# -- WHEN: FAULT INJECTION — destroy the workload ENTIRELY (keep the PVC). --
kubectl -n "$NS" delete pod writer --wait=true --timeout=180s
kubectl -n "$NS" get pvc survivor # PVC must still exist
# -- THEN: a fresh workload re-bound to the same PVC still sees the data. --
apply_pod reader
kubectl -n "$NS" wait --for=condition=Ready pod/reader --timeout=240s
GOT="$(kubectl -n "$NS" exec reader -- cat /data/canary)"
echo "recovered=$GOT expected=$CANARY"
[ "$GOT" = "$CANARY" ] && echo DATA_SURVIVED_OK
check:
# green on either a clean skip (no longhorn) or a proven survival.
($stdout =~ '(DATA_SURVIVED_OK|DATA_SURVIVAL_SKIPPED_OK)'): true
finally:
- script:
content: |
kubectl -n "$NAMESPACE" delete pod writer reader --ignore-not-found --wait=false || true
kubectl -n "$NAMESPACE" delete pvc survivor --ignore-not-found --wait=false || true
echo "cleanup best-effort; chainsaw namespace teardown finalizes"