# =============================================================================
# L0 STATIC — least privilege for workload identities and network reach (R-SEC-02)
# Catalog: docs/14 L0 row, "Manifests/ServiceDefinitions obey invariants" — runs in
#          CI WITHOUT a cluster.
#
# GIVEN the repository as git tracks it,
# WHEN  every tracked RBAC object and every least-network-reach policy is inspected,
# THEN  no in-repo role grants a wildcard or a privilege-escalation verb, no workload
#       ServiceAccount is bound to a privileged role, the conformance runner's own
#       privileged test identity stays scoped to its authored ClusterRole, and each
#       least-network-reach policy both Enforces and is proven by an L0 negative row
#       (or a generated-resource row) to actually close reach.
#
# STATUS: EXECUTABLE — and DELIBERATELY PARTIAL. `check.sh` is a pure offline assertion
# script (git ls-files + PyYAML); conformance/run.sh --layer l0 and ci/l0.sh run it
# directly, and this Chainsaw Test wraps the SAME script. It proves the STATIC half of
# both clauses. The RUNTIME half — that the API server actually denies an unrequested
# verb, and that pod-to-pod traffic is actually dropped — needs a cluster and is NOT
# asserted under this requirement; see the gap list in check.sh's header. R-SEC-02 is
# therefore covered, not finished.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: least-privilege-rbac
  labels:
    conformance.home.k3s/R-SEC-02: "true"
  annotations:
    conformance.home.k3s/requirements: "R-SEC-02"
    conformance.home.k3s/layer: "L0"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      Workload identities carry no wildcard, no escalation verb and no privileged
      binding; the least-network-reach policies are enforced and proven to reject.
spec:
  steps:
    - name: scan-rbac-and-least-reach-policies
      description: >-
        Assert the authored least-privilege posture of every tracked RBAC object and
        the enforced, test-proven status of the least-network-reach policies.
      try:
        - script:
            content: bash ./check.sh