# =============================================================================
# L2 BEHAVIORAL SCAFFOLD — Explicit allow / deny-undeclared  (R-NET-02)
# Catalog: docs/14 "Explicit allow / deny-undeclared (R-NET-02)"
#
# GIVEN a service with declared `dependencies`,
# WHEN  the source reaches a DECLARED dest port  -> THEN it succeeds;
# WHEN  the source reaches an UNDECLARED dest     -> THEN it fails (negative test).
#
# STATUS: scaffold — needs T-2.3 (render dependencies -> CiliumNetworkPolicy).
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: deny-undeclared
  labels:
    conformance.home.k3s/R-NET-02: "true"
  annotations:
    conformance.home.k3s/requirements: "R-NET-02"
    conformance.home.k3s/layer: "L2"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/intent: >-
      A declared dependency connects; an undeclared destination is blocked.
spec:
  steps:
    - name: given-source-with-declared-dependency
      try:
        - apply:
            # TODO(T-2.3): apply a ServiceDefinition/rendered policy where `source`
            # declares dependency on `dest:declared-port`; deploy source + two dests.
            file: fixtures/source-and-dests.yaml   # TODO: author fixtures
    - name: then-declared-succeeds
      try:
        - script:
            content: |
              set -euo pipefail
              kubectl -n "$NAMESPACE" exec source -- nc -z -w 3 declared-dest 80 \
                && echo ALLOW_OK
            check: { ($stdout =~ 'ALLOW_OK'): true }
    - name: then-undeclared-denied
      try:
        - script:
            content: |
              set -euo pipefail
              if kubectl -n "$NAMESPACE" exec source -- nc -z -w 3 undeclared-dest 80; then
                echo "LEAK: undeclared destination reachable" >&2; exit 1
              fi
              echo DENY_OK
            check: { ($stdout =~ 'DENY_OK'): true }