# =============================================================================
# L2 BEHAVIORAL — Trusted TLS  (R-TLS-01, R-TLS-03)   [RUNNABLE]
# Catalog: docs/14 "Trusted TLS (R-TLS-01/02)"
# Spec:    docs/09 (Gateway API + DNS-01 wildcard), ADR-0006 (LE issuers)
#
# GIVEN the shared Gateway terminating TLS with the cert-manager wildcard cert,
# WHEN  a probe dials it (SNI *.home.keithjackson.dev) and verifies the chain,
# THEN  the served cert is non-self-signed, unexpired, covers the wildcard SAN,
#       and CHAINS TO A REAL CA ROOT (R-TLS-01). The wildcard SAN also covers
#       internal-only hostnames, so internal services get the same trusted cert
#       (R-TLS-03).
#
# TRUST MODEL (operator decision "A", DECISIONS-LOG): dev issues from Let's
# Encrypt **STAGING** (ADR-0006, to avoid prod rate limits) — a real CA, but not
# in the system trust store. So the probe verifies the chain against the LE
# STAGING root (fixtures/le-staging-root-ca.yaml, "(STAGING) Pretend Pear X1"),
# which is the faithful "chains to a trusted root" check for this environment.
# A prod overlay (LE-prod) would verify against the system store instead.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: trusted-tls
  labels:
    conformance.home.k3s/R-TLS-01: "true"
    conformance.home.k3s/R-TLS-03: "true"
  annotations:
    conformance.home.k3s/requirements: "R-TLS-01, R-TLS-03"
    conformance.home.k3s/layer: "L2"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      The shared Gateway serves a valid, unexpired, non-self-signed wildcard cert
      that chains to a real CA root (LE-staging in dev); the wildcard SAN covers
      internal-only hostnames too.
spec:
  steps:
    - name: given-le-staging-root-trust-anchor
      try:
        - apply:
            file: fixtures/le-staging-root-ca.yaml
    - name: then-gateway-cert-chains-to-trusted-root
      try:
        - apply:
            resource:
              apiVersion: batch/v1
              kind: Job
              metadata:
                name: tls-probe
              spec:
                backoffLimit: 4
                activeDeadlineSeconds: 120
                template:
                  spec:
                    restartPolicy: Never
                    volumes:
                      - name: ca
                        configMap:
                          name: le-staging-root
                    containers:
                      - name: probe
                        image: curlimages/curl:8.11.1
                        volumeMounts:
                          - name: ca
                            mountPath: /ca
                            readOnly: true
                        command:
                          - sh
                          - -c
                          - |
                            set -eu
                            gw="cilium-gateway-shared.gateway.svc.cluster.local"
                            # Probe TWO wildcard hostnames — one "public", one "internal-only". Both
                            # match *.home.keithjackson.dev, so a clean verify against the LE-staging
                            # root for BOTH proves R-TLS-01 (chains to a real CA root) AND R-TLS-03
                            # (the same trusted wildcard covers internal-only names).
                            # --connect-to sends SNI/Host=$host but DIALS the gateway Service by name
                            # (env-agnostic — no hardcoded VIP). curl (no -f) exits 0 on the gateway's
                            # 404 once TLS+hostname verify; it exits 60 if the chain/hostname fails
                            # (verified empirically), so `set -e` + rc=0 is the assertion. TLS
                            # terminates at the gateway before HTTP routing, so no backend is needed.
                            for host in conformance.home.keithjackson.dev internal-only.home.keithjackson.dev; do
                              curl -sS --cacert /ca/root.pem \
                                   --connect-to "${host}:443:${gw}:443" \
                                   -o /dev/null "https://${host}/"
                              echo "TLS_TRUSTED ${host}"
                            done
                            echo ALL_TRUSTED
        - assert:
            resource:
              apiVersion: batch/v1
              kind: Job
              metadata: { name: tls-probe }
              status: { succeeded: 1 }