# =============================================================================
# Scoped test ServiceAccount + RBAC for the in-cluster Chainsaw conformance Job
# (ADR-0011; docs/14 "Where each layer runs"; R-SEC-02 least-privilege).
#
# SKELETON / PLACEHOLDER — RBAC is deliberately LEFT EMPTY here and authored
# least-privilege as each fault-injection capability actually lands (T-3.0+). The
# rule is: grant nothing until a committed test needs it, then grant exactly that
# verb/resource, with a comment naming the test that requires it. This SA is a
# PRIVILEGED TEST IDENTITY — it is its own audit item (R-SEC-02): it MUST NOT be
# reused by workloads, and every widening is reviewed.
#
# CI holds NO cluster credentials. CI only triggers the Job (T-6.1b via Gitea
# Actions); the Job runs under THIS ServiceAccount, so cluster access stays
# in-cluster and scoped (docs/14, R-SEC-02).
#
# Deployment: reconciled by Flux into the `conformance` namespace once the cluster
# exists (Phase 1+). Not applied in Phase 0 (no cluster).
# =============================================================================
apiVersion: v1
kind: Namespace
metadata:
  name: conformance
  labels:
    app.kubernetes.io/part-of: conformance
    # The test namespace itself is exempt from nothing: the platform default-deny
    # baseline still applies; the Job opens only the egress it declares.
    pod-security.kubernetes.io/enforce: restricted
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: conformance-runner
  namespace: conformance
  labels:
    app.kubernetes.io/part-of: conformance
  annotations:
    conformance.home.k3s/audit: >-
      PRIVILEGED TEST IDENTITY. Scoped least-privilege for fault-injection only.
      Never reuse for workloads. Widen only alongside the test that needs it.
---
# ClusterRole — the union of what BEHAVIOR + FAULT tests need. Every rule is
# commented with the test/requirement that justifies it. Start empty; uncomment /
# add rules as the corresponding L2/L3 tests are delivered (do NOT pre-grant).
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: conformance-runner
  labels:
    app.kubernetes.io/part-of: conformance
rules:
  # ---- Hermetic fixtures (all L2/L3): create/delete throwaway test namespaces + fixtures
  - apiGroups: [""]
    resources: [namespaces]
    # `patch` is required by R-NET-06 (vpn-killswitch): the test relabels its own
    # ephemeral namespace to PodSecurity enforce=privileged so it can launch the
    # node-pinned privileged fault Job. Scoped to the per-test namespace only.
    verbs: [create, delete, get, list, watch, patch]
  - apiGroups: [""]
    resources: [pods, services, configmaps, secrets, persistentvolumeclaims]
    verbs: [create, delete, get, list, watch, patch]
  - apiGroups: [""]
    resources: [pods/exec]
    verbs: [create]                         # probe exec for behavior assertions
  - apiGroups: [""]
    resources: [pods/log]
    verbs: [get]                            # read fault/probe Job logs on failure
  # ---- Probe / fault Jobs (R-TLS-01/03 tls-probe; R-NET-06 tunnel stop/start)
  # `create` cannot be constrained by resourceNames, and the fault Job names are
  # fixed per-test (tunnel-stop/tunnel-start/tunnel-start-finally); scoped by the
  # in-namespace blast radius of the ephemeral test namespace.
  - apiGroups: [batch]
    resources: [jobs]
    verbs: [create, delete, get, list, watch, patch]
  #
  # ---- R-NET-01/02 (default-deny, deny-undeclared): apply/patch/delete allow policies
  # - apiGroups: [cilium.io]
  #   resources: [ciliumnetworkpolicies]
  #   verbs: [create, delete, get, list, patch]
  #
  # ---- R-NET-06 (VPN kill-switch, ADR-0015): the fault is a HOST systemd action
  # (stop/start `vpn-egress-tunnel` on the egress-gateway node), NOT scaling an
  # in-cluster gluetun Deployment (superseded design). It is driven by a privileged,
  # hostPID, node-pinned Job (nsenter -t 1 -- systemctl ...). That power comes from
  # PodSecurity (the test namespace relabeled to enforce=privileged) + the pod's
  # securityContext, NOT from RBAC — the fault Job pod needs NO Kubernetes API
  # rights. The runner only needs `jobs` create/delete + `namespaces` patch above.
  # PREREQUISITE: if a cluster-wide Kyverno disallow-privileged / disallow-host-
  # namespaces policy is enforced, the `chainsaw-conf-*` test namespaces MUST be in
  # its exclusion set (documented, audited exception — R-SEC-02).
  #
  # ---- R-STATE-02 (node loss): cordon/drain/uncordon a node  (NOT in WS-TEST scope yet)
  # - apiGroups: [""]
  #   resources: [nodes]
  #   verbs: [get, list, patch]             # cordon = patch spec.unschedulable
  # - apiGroups: [""]
  #   resources: [pods/eviction]
  #   verbs: [create]                       # drain
  #
  # ---- R-UPD-02 (bad-update auto-rollback): inject a bad image tag via automation
  # - apiGroups: [image.toolkit.fluxcd.io]
  #   resources: [imagepolicies, imagerepositories]
  #   verbs: [get, patch]
  #
  # ---- R-STATE-03 (DR restore): trigger a Velero restore
  # - apiGroups: [velero.io]
  #   resources: [restores, backups]
  #   verbs: [create, get, list, watch]
  #
  # ---- R-GITOPS-03 (drift): mutate a reconciled resource + observe Flux revert
  # - apiGroups: [kustomize.toolkit.fluxcd.io]
  #   resources: [kustomizations]
  #   verbs: [get, list, watch]             # observe only; do NOT grant reconcile suspension
  #
  # ---- R-PLAT-03 (VM lifecycle): create/start/stop/destroy VMs
  # - apiGroups: [kubevirt.io]
  #   resources: [virtualmachines, virtualmachineinstances]
  #   verbs: [create, delete, get, list, patch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: conformance-runner
  labels:
    app.kubernetes.io/part-of: conformance
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: conformance-runner
subjects:
  - kind: ServiceAccount
    name: conformance-runner
    namespace: conformance