# =============================================================================
# L0 STATIC — the scanner's Flux tier cannot stall the platform, and its network reach is exactly what
# docs/17 "Security of the scanner itself" allows (R-VULN-09). Offline, no cluster.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: vuln-scanner-isolation
  labels:
    conformance.home.k3s/R-VULN-09: "true"
  annotations:
    conformance.home.k3s/requirements: "R-VULN-09"
    conformance.home.k3s/layer: "L0"
    conformance.home.k3s/scope: "whole-repo"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      The vuln-scanner Flux tier is wait:false, in neither gating tier, and nothing dependsOn it;
      ingress is exactly the Gateway to 4180, the CI runner to 8081 and Prometheus to 9090;
      egress reaches the API, DNS, the public internet on 443 only with cluster and LAN excluded,
      and the Keycloak path the sidecar needs. Proven by mutation.
spec:
  steps:
    - name: assert-isolation-and-network-shape
      description: >-
        Parse the Flux wiring and networkpolicy.yaml, assert isolation and the exact network shape,
        and run the evaluators on mutated copies to prove they can fail.
      try:
        - script:
            content: bash ./check.sh