# =============================================================================
# L2 BEHAVIORAL SCAFFOLD — the internal API is unreachable from an unrelated namespace  (R-VULN-09)
# Catalog: docs/17 "Acceptance gates" (L2).
#
# A pod in an unrelated namespace cannot reach vuln-scanner :8081 or :9090, while the CI runner identity can reach :8081.
#
# STATUS: scaffold only. It asserts nothing and DOES NOT EXECUTE IN CI: vars.CLUSTER_AVAILABLE is unset,
# so L2/L3 conformance does not run. Coverage from this file is a named gap, not evidence.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: vuln-internal-api-isolated
  labels:
    conformance.home.k3s/R-VULN-09: "true"
  annotations:
    conformance.home.k3s/requirements: "R-VULN-09"
    conformance.home.k3s/layer: "L2"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/intent: >-
      A pod in an unrelated namespace cannot reach vuln-scanner :8081 or :9090, while the CI runner identity can reach :8081.
spec:
  steps:
    - name: given-an-unrelated-namespace
      try:
        - script:
            content: 'echo "TODO: create a throwaway namespace and probe pod"'
    - name: when-connecting
      try:
        - script:
            content: 'echo "TODO: attempt tcp to vuln-scanner:8081 and :9090"'
    - name: then-denied
      try:
        - script:
            content: 'echo "TODO: assert a timeout on both, and success from the act-runner identity on :8081"'