# =============================================================================
# L0 STATIC — PiHole's DNS frontends admit the LAN and the VPN, and nothing public
# Catalog: docs/14 L0 row ("Pre-apply, in CI") — runs WITHOUT a cluster.
#
# loadBalancerSourceRanges is the only thing keeping PiHole from being an open resolver, and it
# must also carry the WireGuard client subnet, because Cilium load-balances tunnel traffic on wg0
# before the iptables MASQUERADE (so the source it tests is still 10.90.0.x). check.sh's header
# states the assertions and what they do not prove.
#
# STATUS: EXECUTABLE. `check.sh` is a pure offline assertion script (standard library + PyYAML);
# conformance/run.sh --layer l0 runs it directly and this Chainsaw Test wraps the SAME script.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: pihole-dns-source-ranges
  labels:
    conformance.home.k3s/R-DNS-03: "true"
  annotations:
    conformance.home.k3s/requirements: "R-DNS-03"
    conformance.home.k3s/layer: "L0"
    # WHOLE-REPO SCOPE: ci/touched-requirements.sh maps apps/* to no R-DNS requirement, so a change
    # to these Services would otherwise select nothing.
    conformance.home.k3s/scope: "whole-repo"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      Every PiHole LoadBalancer Service lists both the LAN and the WireGuard client subnet in
      loadBalancerSourceRanges, and every range resolves to RFC1918, so VPN clients can resolve
      and PiHole stays unreachable from the internet.
spec:
  steps:
    - name: assert-pihole-source-ranges
      description: >-
        Collect the PiHole LoadBalancer Services, resolve each source range through cluster-vars,
        and assert both required ranges are present and every range is private.
      try:
        - script:
            content: bash ./check.sh