# =============================================================================
# L2 BEHAVIORAL SCAFFOLD — DNS / exposure  (R-DNS-01, R-DNS-02, R-DNS-03)
# Catalog: docs/14 "DNS/exposure (R-DNS-*)"
#
# GIVEN a service,
# WHEN  it is resolved,
# THEN  the record exists (auto-managed) and internal clients hit the internal
#       Gateway; an `internal` service is unreachable publicly while a `public`
#       service is reachable + TLS-valid.
#
# STATUS: scaffold — needs T-2.5 (ExternalDNS + Gateway + split-horizon PiHole).
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: dns-exposure
  labels:
    conformance.home.k3s/R-DNS-01: "true"
    conformance.home.k3s/R-DNS-02: "true"
    conformance.home.k3s/R-DNS-03: "true"
  annotations:
    conformance.home.k3s/requirements: "R-DNS-01, R-DNS-02, R-DNS-03"
    conformance.home.k3s/layer: "L2"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/intent: >-
      Record auto-appears; internal clients resolve to the internal Gateway;
      internal is not public, public is reachable + TLS-valid.
spec:
  steps:
    - name: given-a-declared-service
      try:
        - script:
            content: 'echo "TODO(T-2.5): onboard a service via ServiceDefinition"'
    - name: then-record-exists-auto-managed
      try:
        - script:
            # R-DNS-01/02: the <service>.home.keithjackson.dev record appears with
            # no manual step (ExternalDNS from declared intent).
            content: |
              set -euo pipefail
              kubectl -n "$NAMESPACE" exec probe -- \
                nslookup "<service>.home.keithjackson.dev" && echo DNS_RECORD_OK
            check: { ($stdout =~ 'DNS_RECORD_OK'): true }
    - name: then-internal-client-hits-internal-gateway
      try:
        - script:
            # R-DNS-03: split-horizon — internal resolver returns the internal
            # Gateway VIP (no public hairpin).
            content: 'echo "TODO(T-2.5): assert resolved IP == internal Gateway VIP"'
    - name: then-internal-unreachable-publicly-public-reachable
      try:
        - script:
            content: 'echo "TODO: assert internal not public; public reachable + TLS-valid"'