# =============================================================================
# L1 RENDERING SCAFFOLD — egress class renders the kill-switched path
#                         (R-NET-05, R-NET-06, R-NET-07)
# Catalog: docs/14 L1 example "`egress: vpn` renders the kill-switched egress path"
#
# L1 verifies the ServiceDefinition -> rendered-resources mapping matches golden
# expectations, WITHOUT asserting runtime behavior. This is NOT a substitute for
# the L2/L3 behavior tests (R-TEST-01): rendering the policy != enforcing it.
#
# GIVEN a ServiceDefinition with `egress: vpn`,
# WHEN  the renderer produces resources,
# THEN  the output includes the egress-gateway steering + kill-switch construct
#       (and `egress: internet` does NOT), and flipping the class only changes the
#       egress path (R-NET-07), not the workload spec.
#
# STATUS: scaffold — needs T-0.3 (renderer contract) + T-3.1/T-3.2 (egress design).
# Rendering assertions can run without live behavior, but Chainsaw applies to a
# cluster; until Phase 1 this is skipped by run.sh like every other layer.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: egress-class-render
  labels:
    conformance.home.k3s/R-NET-05: "true"
    conformance.home.k3s/R-NET-06: "true"
    conformance.home.k3s/R-NET-07: "true"
  annotations:
    conformance.home.k3s/requirements: "R-NET-05, R-NET-06, R-NET-07"
    conformance.home.k3s/layer: "L1"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/intent: >-
      egress: vpn renders the egress-gateway + kill-switch path; internet does not.
spec:
  steps:
    - name: given-vpn-servicedefinition-render
      try:
        - script:
            # TODO(T-0.3): invoke the renderer on a fixture ServiceDefinition
            # (egress: vpn) and capture rendered YAML to $RENDER_OUT.
            content: 'echo "TODO: render fixtures/svcdef-egress-vpn.yaml -> rendered.yaml"'
    - name: then-render-contains-killswitched-egress
      try:
        - assert:
            # TODO(T-3.x): assert the rendered set includes the egress-gateway
            # steering + kill-switch construct for a vpn-class workload.
            file: golden/egress-vpn.expected.yaml   # TODO: author golden file
    - name: then-internet-render-omits-vpn-path
      try:
        - script:
            content: 'echo "TODO: render egress: internet fixture; assert NO vpn/gateway steer"'