Autonomous session: Phase-2 platform authoring + Flux bootstrap progress
Author-only Phase-2 components (platform suspended; cluster untouched): - platform/longhorn: 3-replica SC + bulk external-mount indirection (R-STATE) - platform/monitoring: kube-prometheus-stack + Loki + Alloy (dev-trimmed) + 8 alert rules (R-OBS) - platform/cilium: parity fix (k8sServiceHost=10.73.0.11 + masquerade) safe to adopt Phase 2 - conformance: partial L2 tests (worker hit session limit; incomplete — see DECISIONS-LOG K2) - bootstrap/gitea: fix rootless-podman perms (host bind-mount -> named volume) Flux installed on the cluster; host Gitea up + repo pushed; GitRepository BLOCKED by host firewalld (VM->10.73.0.1:3000) — needs one operator sudo command (DECISIONS-LOG). Known issue K1: cluster-vars substitution-var case mismatch (fix before un-suspend). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed
1 parent
397f29e99a
commit
cc89b4b830
19 files changed
+1567
-221
No files matched your search
@@ -1,23 +1,26 @@
|
||||
# =============================================================================
|
||||
# L2 BEHAVIORAL SCAFFOLD — Default-deny east-west (R-NET-01)
|
||||
# L2 BEHAVIORAL — Default-deny east-west (R-NET-01) [RUNNABLE]
|
||||
# Catalog: docs/14-testing-and-conformance.md "Default-deny (R-NET-01)"
|
||||
# Spec: docs/03-networking-isolation-and-egress.md "Default-deny baseline"
|
||||
#
|
||||
# EXEMPLAR: this file is the reference for the tagging convention and step
|
||||
# style. Other scaffolds follow the same shape (see tests/README.md).
|
||||
#
|
||||
# GIVEN a fresh workload in a namespace with no allow rules,
|
||||
# GIVEN a fresh workload in a namespace with the default-deny baseline applied,
|
||||
# WHEN it attempts any in-cluster connection except DNS,
|
||||
# THEN the connection FAILS (fail-closed); DNS still succeeds.
|
||||
#
|
||||
# This asserts observable BEHAVIOR (a probe cannot connect), not the mere
|
||||
# existence of a NetworkPolicy object (R-TEST-01). Safety-relevant: the
|
||||
# fail-closed direction is also exercised under fault-injection at L3
|
||||
# (kill-switch / drift), but the baseline deny is a behavioral must-pass.
|
||||
# This asserts observable BEHAVIOR (a probe Job cannot connect) via ephemeral
|
||||
# probe pods, not the mere existence of a policy object (R-TEST-01).
|
||||
#
|
||||
# STATUS: scaffold — cannot run until Phase 2 delivers the default-deny
|
||||
# baseline (T-2.2). Chainsaw auto-creates/cleans the namespace (hermetic).
|
||||
# TODOs mark fixtures that land as later phases deliver.
|
||||
# RUNNABLE ON THE BASE CLUSTER: the platform-wide default-deny baseline (T-2.2)
|
||||
# is not yet applied cluster-wide, so this test applies an equivalent baseline
|
||||
# as its OWN hermetic fixture in the per-test namespace. The fixture is a
|
||||
# standard Kubernetes NetworkPolicy (Cilium enforces it) — portable and
|
||||
# version-agnostic; the platform's baseline will be the CiliumNetworkPolicy
|
||||
# equivalent, but the asserted BEHAVIOR (DNS-only egress) is identical, which
|
||||
# is what R-TEST-01 requires us to prove. Chainsaw auto-creates/cleans the
|
||||
# namespace (hermetic); the probe Jobs are ephemeral and self-cleaned with it.
|
||||
# =============================================================================
|
||||
apiVersion: chainsaw.kyverno.io/v1alpha1
|
||||
kind: Test
|
||||
@@ -30,69 +33,123 @@ metadata:
|
||||
conformance.home.k3s/requirements: "R-NET-01"
|
||||
conformance.home.k3s/layer: "L2"
|
||||
conformance.home.k3s/safety-critical: "false"
|
||||
# executable => this test runs real behavior against a cluster (not a scaffold).
|
||||
conformance.home.k3s/executable: "true"
|
||||
conformance.home.k3s/intent: >-
|
||||
Given a bare workload with no allow rules, only DNS egress succeeds;
|
||||
every other in-cluster connection is denied.
|
||||
Given a bare workload in a namespace with the default-deny baseline, only
|
||||
DNS egress succeeds; every other in-cluster connection is denied.
|
||||
spec:
|
||||
steps:
|
||||
# -- GIVEN: a fresh, unprivileged probe workload with zero allow rules. The
|
||||
# per-test namespace inherits the platform default-deny baseline (T-2.2).
|
||||
- name: given-bare-probe-workload
|
||||
# -- GIVEN: apply the default-deny baseline to the per-test namespace. Deny all
|
||||
# ingress + egress for every pod; allow ONLY DNS egress to the in-cluster
|
||||
# resolver. This is the hermetic stand-in for the platform baseline (T-2.2).
|
||||
- name: given-default-deny-baseline
|
||||
try:
|
||||
- apply:
|
||||
# TODO(T-2.2): once the namespaced default-deny CiliumNetworkPolicy
|
||||
# baseline exists, assert it is present AND that the probe below is
|
||||
# actually blocked (existence != enforcement, R-TEST-01).
|
||||
resource:
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: probe
|
||||
labels: { app: conformance-probe }
|
||||
name: default-deny-baseline
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: probe
|
||||
image: ghcr.io/kyverno/kyvernopre:latest # TODO: pin a curl/nc probe image
|
||||
command: ["sleep", "3600"]
|
||||
- assert:
|
||||
resource:
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata: { name: probe }
|
||||
status: { phase: Running }
|
||||
podSelector: {}
|
||||
policyTypes: [Ingress, Egress]
|
||||
# no ingress rules => deny all ingress
|
||||
ingress: []
|
||||
# only DNS egress to kube-dns (CoreDNS) in kube-system
|
||||
egress:
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
podSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
ports:
|
||||
- protocol: UDP
|
||||
port: 53
|
||||
- protocol: TCP
|
||||
port: 53
|
||||
|
||||
# -- THEN(DNS allowed): DNS egress MUST succeed even under default-deny.
|
||||
# -- THEN(DNS allowed): DNS egress MUST succeed even under default-deny. An
|
||||
# ephemeral Job resolves an in-cluster name; we assert the Job SUCCEEDS.
|
||||
# (Chainsaw polls the Job status within the assert timeout — bounded, no sleeps.)
|
||||
- name: then-dns-succeeds
|
||||
try:
|
||||
- script:
|
||||
# TODO(T-2.2): resolve an in-cluster name via kube-dns; expect rc=0.
|
||||
content: |
|
||||
set -euo pipefail
|
||||
kubectl -n "$NAMESPACE" exec probe -- \
|
||||
sh -c 'nslookup kubernetes.default.svc.cluster.local' && echo DNS_OK
|
||||
check:
|
||||
# bounded, deterministic: no sleeps; chainsaw retries within timeout.
|
||||
($stdout =~ 'DNS_OK'): true
|
||||
- apply:
|
||||
resource:
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: dns-probe
|
||||
spec:
|
||||
backoffLimit: 4
|
||||
activeDeadlineSeconds: 120
|
||||
template:
|
||||
metadata:
|
||||
labels: { app: conformance-probe }
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: probe
|
||||
image: busybox:1.36.1
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -eu
|
||||
# DNS is the one egress the baseline permits.
|
||||
nslookup kubernetes.default.svc.cluster.local
|
||||
echo DNS_OK
|
||||
- assert:
|
||||
resource:
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata: { name: dns-probe }
|
||||
status: { succeeded: 1 }
|
||||
|
||||
# -- THEN(everything else denied): a non-DNS in-cluster connection MUST fail.
|
||||
# -- THEN(everything else denied): a non-DNS in-cluster connection MUST fail
|
||||
# closed. The Job attempts to reach the kube-apiserver ClusterIP (always
|
||||
# present) on 443; the probe EXITS 0 only when that connection is BLOCKED,
|
||||
# so a green Job proves the deny. A leak (connection succeeds) fails the Job.
|
||||
- name: then-nondns-denied
|
||||
try:
|
||||
- script:
|
||||
# TODO(T-2.2 / T-2.6): target an in-cluster service (e.g. Plex/Gateway)
|
||||
# on a real port; expect the connection to FAIL closed (non-zero / timeout).
|
||||
content: |
|
||||
set -euo pipefail
|
||||
if kubectl -n "$NAMESPACE" exec probe -- \
|
||||
sh -c 'nc -z -w 3 <in-cluster-service> 80'; then
|
||||
echo "LEAK: connection succeeded under default-deny" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo DENIED_OK
|
||||
check:
|
||||
($stdout =~ 'DENIED_OK'): true
|
||||
# -- finally: chainsaw deletes the namespace + probe automatically; this block
|
||||
# is the explicit hook for any out-of-namespace fixtures (none here).
|
||||
- apply:
|
||||
resource:
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: block-probe
|
||||
spec:
|
||||
backoffLimit: 4
|
||||
activeDeadlineSeconds: 120
|
||||
template:
|
||||
metadata:
|
||||
labels: { app: conformance-probe }
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: probe
|
||||
image: busybox:1.36.1
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -u
|
||||
# DNS resolves (allowed); the TCP connect must be dropped.
|
||||
if nc -w 4 kubernetes.default.svc.cluster.local 443 </dev/null 2>/dev/null; then
|
||||
echo "LEAK: reached kube-apiserver under default-deny" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
echo DENIED_OK
|
||||
- assert:
|
||||
resource:
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata: { name: block-probe }
|
||||
status: { succeeded: 1 }
|
||||
# -- chainsaw deletes the namespace (policy + probe Jobs) automatically; this
|
||||
# block is the explicit hook for any out-of-namespace fixtures (none here).
|
||||
finally:
|
||||
- script:
|
||||
content: 'echo "cleanup handled by chainsaw namespace teardown"'
|
||||
Reference in new issue
Block a user