# =============================================================================
# L1 RENDERING SCAFFOLD — every namespace renders a default-deny baseline
#                         (R-NET-01)
# Catalog: docs/14 L0/L1 "Every namespace has a default-deny baseline"
#
# GIVEN any onboarded service (any namespace),
# WHEN  its resources are rendered,
# THEN  the render includes the namespaced default-deny baseline policy.
#
# This is the RENDER-TIME partner of the L2 behavioral default-deny test and of
# the L0 Kyverno gate (T-0.5). Rendering the baseline is necessary but NOT
# sufficient — enforcement is proven behaviorally at L2 (R-TEST-01).
#
# STATUS: IMPLEMENTED (T-0.3). render-check.sh renders a service and asserts the
# namespaced default-deny baseline is present + shaped (deny-all, both directions) —
# a pure offline check (renderer + golden diff, no cluster). conformance/run.sh --layer
# l1 and ci/l1.sh run it directly; this Chainsaw Test wraps the SAME script so an
# in-cluster run executes the identical assertion. Rendering != enforcement (proven L2).
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: default-deny-baseline-render
  labels:
    conformance.home.k3s/R-NET-01: "true"
  annotations:
    conformance.home.k3s/requirements: "R-NET-01"
    conformance.home.k3s/layer: "L1"
    conformance.home.k3s/safety-critical: "false"
    # WHY SCOPE, NOT REQUIREMENTS ALONE: every L1 test exercises ONE shared code path —
    # catalog/render.py against schemas/servicedefinition.schema.json — so anything that changes
    # rendered output breaks these goldens regardless of which requirement the touched path maps to.
    # Requirement-scoped selection cannot see that coupling. Concretely (2026-09-04 external-dns
    # merge): `platform/externaldns/helmrelease.yaml` attributes R-ENV-02, R-OBS-01/02/04,
    # R-STATE-03 and R-TEST-01/02/03/04 via ci/touched-requirements.sh — NOT R-PLAT-02, R-NET-01 or
    # R-NET-05/06/07 — yet it added `external-dns.alpha.kubernetes.io/controller: none` to the
    # rendered output of ALL THREE L1 goldens. A requirement-scoped gate selected ZERO L1 tests, went
    # GREEN, and left every golden stale; the staleness surfaced only on a later full run.
    # ci/l1.sh has passed --include-scope since it was written, waiting for this annotation.
    conformance.home.k3s/scope: "whole-repo"
    conformance.home.k3s/intent: >-
      Rendering any service's namespace yields a default-deny baseline policy.
spec:
  steps:
    - name: render-and-assert-default-deny
      description: >-
        Render a service and assert the namespaced default-deny baseline is present and
        shaped (deny-all ingress, both Ingress+Egress), matching the golden.
      try:
        - script:
            content: bash ./render-check.sh