# =============================================================================
# L1 RENDERING — kind: container renders the PaaS workload (R-PLAT-02)
# Catalog: docs/13 `kind: container` (PaaS default). The render analog of the
# vm-lifecycle (R-PLAT-03) test for the container path.
#
# GIVEN a kind: container ServiceDefinition,
# WHEN  the renderer produces resources,
# THEN  it renders a Deployment (the container workload) + a Service, matching the
#       golden, with the egress-class + auth-mode labels admission requires.
#
# STATUS: IMPLEMENTED (T-0.3). render-check.sh is a pure offline check (renderer +
# golden diff + structural asserts, no cluster). conformance/run.sh --layer l1 and
# ci/l1.sh run it directly; this Chainsaw Test wraps the SAME script so an in-cluster
# run executes the identical assertion. Rendering != enforcement (behavior at L2).
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: container-workload-render
  labels:
    conformance.home.k3s/R-PLAT-02: "true"
  annotations:
    conformance.home.k3s/requirements: "R-PLAT-02"
    conformance.home.k3s/layer: "L1"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/intent: >-
      A kind: container ServiceDefinition renders a Deployment + Service (the PaaS path).
spec:
  steps:
    - name: render-and-assert-container-workload
      description: >-
        Render a container ServiceDefinition and assert it produces a Deployment running
        the declared image plus a Service, with the required pod labels, matching golden.
      try:
        - script:
            content: bash ./render-check.sh