# =============================================================================
# L2 BEHAVIORAL SCAFFOLD — VM lifecycle  (R-PLAT-03)
# Catalog: docs/14 "VM lifecycle (R-PLAT-03, L2/L3)"
#
# GIVEN a `kind: vm` ServiceDefinition,
# WHEN  it is created/started/stopped/destroyed via kubectl/virtctl,
# THEN  it behaves through the same K8s surface; default-deny + egress class
#       apply to it. (Disk-survives-rebuild is the L3 partner test, see
#       tests/l3-fault-injection/data-survival — VMs share R-STATE-01.)
#
# STATUS: scaffold — needs T-5.1/T-5.2 (KubeVirt + `kind: vm` path).
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: vm-lifecycle
  labels:
    conformance.home.k3s/R-PLAT-03: "true"
  annotations:
    conformance.home.k3s/requirements: "R-PLAT-03"
    conformance.home.k3s/layer: "L2"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/intent: >-
      A VM is created/started/stopped/destroyed via the K8s API; policy applies.
spec:
  steps:
    - name: given-vm-servicedefinition
      try:
        - apply:
            file: fixtures/vm-servicedefinition.yaml   # TODO(T-5.2): author
    - name: when-start-and-assert-running
      try:
        - script:
            content: |
              set -euo pipefail
              # virtctl start via the same kubectl surface; assert VMI Running.
              kubectl -n "$NAMESPACE" patch vm demo --type merge -p '{"spec":{"running":true}}'
              echo "TODO(T-5.3): wait VMI phase=Running (bounded), then STARTED_OK"
    - name: then-default-deny-and-egress-apply-to-vm
      try:
        - script:
            content: 'echo "TODO: run default-deny + egress-class probes from inside the VM"'
    - name: when-stop-and-destroy
      try:
        - script:
            content: 'echo "TODO(T-5.3): stop then delete VM via kubectl; assert gone"'