Autonomous session: Phase-2 platform authoring + Flux bootstrap progress
Author-only Phase-2 components (platform suspended; cluster untouched): - platform/longhorn: 3-replica SC + bulk external-mount indirection (R-STATE) - platform/monitoring: kube-prometheus-stack + Loki + Alloy (dev-trimmed) + 8 alert rules (R-OBS) - platform/cilium: parity fix (k8sServiceHost=10.73.0.11 + masquerade) safe to adopt Phase 2 - conformance: partial L2 tests (worker hit session limit; incomplete — see DECISIONS-LOG K2) - bootstrap/gitea: fix rootless-podman perms (host bind-mount -> named volume) Flux installed on the cluster; host Gitea up + repo pushed; GitRepository BLOCKED by host firewalld (VM->10.73.0.1:3000) — needs one operator sudo command (DECISIONS-LOG). Known issue K1: cluster-vars substitution-var case mismatch (fix before un-suspend). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed
1 parent
397f29e99a
commit
cc89b4b830
19 files changed
+1567
-221
No files matched your search
@@ -1,12 +1,20 @@
|
||||
# =============================================================================
|
||||
# L2 BEHAVIORAL SCAFFOLD — Explicit allow / deny-undeclared (R-NET-02)
|
||||
# L2 BEHAVIORAL — Explicit allow / deny-undeclared (R-NET-02) [RUNNABLE]
|
||||
# Catalog: docs/14 "Explicit allow / deny-undeclared (R-NET-02)"
|
||||
# Spec: docs/03-networking-isolation-and-egress.md "Explicit allow rules"
|
||||
#
|
||||
# GIVEN a service with declared `dependencies`,
|
||||
# WHEN the source reaches a DECLARED dest port -> THEN it succeeds;
|
||||
# WHEN the source reaches an UNDECLARED dest -> THEN it fails (negative test).
|
||||
# GIVEN a namespace with default-deny + ONE explicit allow (source -> declared-dest:8080),
|
||||
# WHEN the source reaches the DECLARED dest port -> THEN it succeeds;
|
||||
# WHEN the source reaches an UNDECLARED port (9090) -> THEN it fails;
|
||||
# WHEN the source reaches an UNDECLARED dest (other) -> THEN it fails.
|
||||
#
|
||||
# STATUS: scaffold — needs T-2.3 (render dependencies -> CiliumNetworkPolicy).
|
||||
# The destinations LISTEN on every probed port, so a block is caused by POLICY,
|
||||
# not by a missing listener — this asserts BEHAVIOR, not object existence (R-TEST-01).
|
||||
#
|
||||
# RUNNABLE ON THE BASE CLUSTER: the fixture supplies the default-deny baseline and
|
||||
# the single allow (fixtures/source-and-dests.yaml); Cilium enforces the standard
|
||||
# NetworkPolicies. Probes are ephemeral Jobs labeled app=source so the allow/deny
|
||||
# rules apply to them; chainsaw namespace teardown cleans everything.
|
||||
# =============================================================================
|
||||
apiVersion: chainsaw.kyverno.io/v1alpha1
|
||||
kind: Test
|
||||
@@ -18,31 +26,145 @@ metadata:
|
||||
conformance.home.k3s/requirements: "R-NET-02"
|
||||
conformance.home.k3s/layer: "L2"
|
||||
conformance.home.k3s/safety-critical: "false"
|
||||
conformance.home.k3s/executable: "true"
|
||||
conformance.home.k3s/intent: >-
|
||||
A declared dependency connects; an undeclared destination is blocked.
|
||||
A declared dependency (source->declared-dest:8080) connects; an undeclared
|
||||
port and an undeclared destination are both blocked by policy.
|
||||
spec:
|
||||
steps:
|
||||
# -- GIVEN: baseline + one explicit allow + two live destinations. Wait until
|
||||
# both destinations are Ready so a later block is unambiguously policy-caused.
|
||||
- name: given-source-with-declared-dependency
|
||||
try:
|
||||
- apply:
|
||||
# TODO(T-2.3): apply a ServiceDefinition/rendered policy where `source`
|
||||
# declares dependency on `dest:declared-port`; deploy source + two dests.
|
||||
file: fixtures/source-and-dests.yaml # TODO: author fixtures
|
||||
file: fixtures/source-and-dests.yaml
|
||||
- assert:
|
||||
resource:
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata: { name: declared-dest }
|
||||
status:
|
||||
conditions:
|
||||
- type: Ready
|
||||
status: "True"
|
||||
- assert:
|
||||
resource:
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata: { name: other-dest }
|
||||
status:
|
||||
conditions:
|
||||
- type: Ready
|
||||
status: "True"
|
||||
|
||||
# -- THEN(declared succeeds): source -> declared-dest:8080 connects. Green Job = allowed.
|
||||
- name: then-declared-succeeds
|
||||
try:
|
||||
- script:
|
||||
content: |
|
||||
set -euo pipefail
|
||||
kubectl -n "$NAMESPACE" exec source -- nc -z -w 3 declared-dest 80 \
|
||||
&& echo ALLOW_OK
|
||||
check: { ($stdout =~ 'ALLOW_OK'): true }
|
||||
- name: then-undeclared-denied
|
||||
- apply:
|
||||
resource:
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: probe-allowed
|
||||
spec:
|
||||
backoffLimit: 4
|
||||
activeDeadlineSeconds: 120
|
||||
template:
|
||||
metadata:
|
||||
labels: { app: source }
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: probe
|
||||
image: busybox:1.36.1
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -eu
|
||||
nc -w 5 declared-dest 8080 </dev/null
|
||||
echo ALLOW_OK
|
||||
- assert:
|
||||
resource:
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata: { name: probe-allowed }
|
||||
status: { succeeded: 1 }
|
||||
|
||||
# -- THEN(undeclared PORT denied): source -> declared-dest:9090 is blocked.
|
||||
# The Job EXITS 0 only when the connection is BLOCKED (green Job = deny).
|
||||
- name: then-undeclared-port-denied
|
||||
try:
|
||||
- apply:
|
||||
resource:
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: probe-undeclared-port
|
||||
spec:
|
||||
backoffLimit: 4
|
||||
activeDeadlineSeconds: 120
|
||||
template:
|
||||
metadata:
|
||||
labels: { app: source }
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: probe
|
||||
image: busybox:1.36.1
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -u
|
||||
if nc -w 5 declared-dest 9090 </dev/null 2>/dev/null; then
|
||||
echo "LEAK: undeclared port 9090 reachable" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
echo DENY_PORT_OK
|
||||
- assert:
|
||||
resource:
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata: { name: probe-undeclared-port }
|
||||
status: { succeeded: 1 }
|
||||
|
||||
# -- THEN(undeclared DEST denied): source -> other-dest:8080 is blocked.
|
||||
- name: then-undeclared-dest-denied
|
||||
try:
|
||||
- apply:
|
||||
resource:
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: probe-undeclared-dest
|
||||
spec:
|
||||
backoffLimit: 4
|
||||
activeDeadlineSeconds: 120
|
||||
template:
|
||||
metadata:
|
||||
labels: { app: source }
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: probe
|
||||
image: busybox:1.36.1
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -u
|
||||
if nc -w 5 other-dest 8080 </dev/null 2>/dev/null; then
|
||||
echo "LEAK: undeclared destination reachable" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
echo DENY_DEST_OK
|
||||
- assert:
|
||||
resource:
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata: { name: probe-undeclared-dest }
|
||||
status: { succeeded: 1 }
|
||||
finally:
|
||||
- script:
|
||||
content: |
|
||||
set -euo pipefail
|
||||
if kubectl -n "$NAMESPACE" exec source -- nc -z -w 3 undeclared-dest 80; then
|
||||
echo "LEAK: undeclared destination reachable" >&2; exit 1
|
||||
fi
|
||||
echo DENY_OK
|
||||
check: { ($stdout =~ 'DENY_OK'): true }
|
||||
content: 'echo "cleanup handled by chainsaw namespace teardown"'
|
||||
@@ -0,0 +1,141 @@
|
||||
# =============================================================================
|
||||
# Fixtures for the deny-undeclared behavior test (R-NET-02).
|
||||
# Applied into the per-test namespace chainsaw creates (hermetic, self-cleaned).
|
||||
#
|
||||
# Models: a namespace default-deny baseline + ONE explicit declared dependency
|
||||
# source(app=source) --> declared-dest : tcp/8080
|
||||
# Everything else (declared-dest:9090, other-dest:8080) is UNDECLARED and must
|
||||
# be blocked purely by policy. The destinations LISTEN on those ports, so a
|
||||
# blocked probe proves policy enforcement, not a missing listener.
|
||||
#
|
||||
# Standard Kubernetes NetworkPolicy is used (Cilium enforces it) for portability;
|
||||
# the platform will render CiliumNetworkPolicies from catalog `dependencies`
|
||||
# (T-2.3), but the asserted BEHAVIOR is identical (R-TEST-01).
|
||||
# =============================================================================
|
||||
---
|
||||
# --- Default-deny baseline: deny all ingress+egress, allow only DNS egress. -----------
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: default-deny-baseline
|
||||
spec:
|
||||
podSelector: {}
|
||||
policyTypes: [Ingress, Egress]
|
||||
ingress: []
|
||||
egress:
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
podSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
ports:
|
||||
- protocol: UDP
|
||||
port: 53
|
||||
- protocol: TCP
|
||||
port: 53
|
||||
---
|
||||
# --- The ONE explicit allow (a declared dependency): source --> declared-dest tcp/8080.
|
||||
# Expressed as the two matching halves a real rendered dependency produces:
|
||||
# egress permit on the source, ingress permit on the destination.
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: allow-source-to-declared-8080-egress
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels: { app: source }
|
||||
policyTypes: [Egress]
|
||||
egress:
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels: { app: declared-dest }
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: allow-source-to-declared-8080-ingress
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels: { app: declared-dest }
|
||||
policyTypes: [Ingress]
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels: { app: source }
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
---
|
||||
# --- declared-dest: LISTENS on BOTH 8080 (declared) and 9090 (undeclared port). --------
|
||||
# Two agnhost netexec containers, each an HTTP listener; a TCP connect on
|
||||
# either port reaches a live socket, so a block is caused only by policy.
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: declared-dest
|
||||
labels: { app: declared-dest }
|
||||
spec:
|
||||
containers:
|
||||
- name: dest-8080
|
||||
image: registry.k8s.io/e2e-test-images/agnhost:2.47
|
||||
args: ["netexec", "--http-port=8080"]
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
readinessProbe:
|
||||
tcpSocket: { port: 8080 }
|
||||
periodSeconds: 2
|
||||
- name: dest-9090
|
||||
image: registry.k8s.io/e2e-test-images/agnhost:2.47
|
||||
args: ["netexec", "--http-port=9090"]
|
||||
ports:
|
||||
- containerPort: 9090
|
||||
readinessProbe:
|
||||
tcpSocket: { port: 9090 }
|
||||
periodSeconds: 2
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: declared-dest
|
||||
spec:
|
||||
selector: { app: declared-dest }
|
||||
ports:
|
||||
- name: p8080
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
- name: p9090
|
||||
port: 9090
|
||||
targetPort: 9090
|
||||
---
|
||||
# --- other-dest: an UNDECLARED destination. Listens on 8080 but no allow reaches it. ---
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: other-dest
|
||||
labels: { app: other-dest }
|
||||
spec:
|
||||
containers:
|
||||
- name: dest-8080
|
||||
image: registry.k8s.io/e2e-test-images/agnhost:2.47
|
||||
args: ["netexec", "--http-port=8080"]
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
readinessProbe:
|
||||
tcpSocket: { port: 8080 }
|
||||
periodSeconds: 2
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: other-dest
|
||||
spec:
|
||||
selector: { app: other-dest }
|
||||
ports:
|
||||
- name: p8080
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
Reference in new issue
Block a user