# =============================================================================
# L1 RENDERING SCAFFOLD — egress class renders the kill-switched path
#                         (R-NET-05, R-NET-06, R-NET-07)
# Catalog: docs/14 L1 example "`egress: vpn` renders the kill-switched egress path"
#
# L1 verifies the ServiceDefinition -> rendered-resources mapping matches golden
# expectations, WITHOUT asserting runtime behavior. This is NOT a substitute for
# the L2/L3 behavior tests (R-TEST-01): rendering the policy != enforcing it.
#
# GIVEN a ServiceDefinition with `egress: vpn`,
# WHEN  the renderer produces resources,
# THEN  the output includes the egress-gateway steering + kill-switch construct
#       (and `egress: internet` does NOT), and flipping the class only changes the
#       egress path (R-NET-07), not the workload spec.
#
# STATUS: IMPLEMENTED (T-0.3). The render assertion is a pure offline check
# (render-check.sh: renderer + golden diff, no cluster). conformance/run.sh --layer l1
# and ci/l1.sh run render-check.sh directly WITHOUT a cluster (docs/14: "L1 rendering
# assertions run in CI without a cluster"). This Chainsaw Test wraps the SAME
# render-check.sh in a script step so an in-cluster Chainsaw run executes the identical
# assertion — rendering the policy, NOT enforcing it (enforcement is proven at L2/L3).
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: egress-class-render
  labels:
    conformance.home.k3s/R-NET-05: "true"
    conformance.home.k3s/R-NET-06: "true"
    conformance.home.k3s/R-NET-07: "true"
  annotations:
    conformance.home.k3s/requirements: "R-NET-05, R-NET-06, R-NET-07"
    conformance.home.k3s/layer: "L1"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/intent: >-
      egress: vpn renders the egress-gateway + kill-switch path; internet does not.
spec:
  steps:
    - name: render-and-assert-egress-class
      description: >-
        Render the vpn + internet fixtures and assert: each matches its golden; the vpn
        render carries the egress-class=vpn steering label and internet does not; and the
        two renders differ ONLY in the egress-class value (R-NET-07).
      try:
        - script:
            content: bash ./render-check.sh