jakman85andClaude Opus 5
b389566641
All three L1 tests now declare `conformance.home.k3s/scope: "whole-repo"`.
ci/l1.sh has passed --include-scope whole-repo since it was written, with a
comment saying no L1 test declared the scope yet and it was wired ahead of time
so the next whole-repo invariant "at any layer" would be picked up by annotation
alone. Nothing ever declared it. The consequence is that the entire L1 rendering
layer only ran when a touched path happened to attribute R-PLAT-02, R-NET-01 or
R-NET-05/06/07 — a fail-open hole for every other change in the repo.
The coupling requirement-scoped selection cannot see is that all three tests
exercise ONE code path: catalog/render.py against
schemas/servicedefinition.schema.json. Anything that changes rendered output
invalidates these goldens no matter which requirement the touched path maps to.
The 2026-09-04 external-dns merge is the proof, measured rather than asserted.
ci/touched-requirements.sh attributes platform/externaldns/helmrelease.yaml to
R-ENV-02, R-OBS-01/02/04, R-STATE-03 and R-TEST-01/02/03/04 — none of the
rendering requirements — yet that change added
external-dns.alpha.kubernetes.io/controller: none
to the rendered output of all three goldens. Via --print-selection:
requirement-scoped only (the 2026-09-04 behaviour): 0 L1 tests selected
with --include-scope whole-repo (how ci/l1.sh runs): 3 L1 tests selected
So the merge gated GREEN while leaving every rendering golden stale, and the
staleness surfaced only on a later full run.
Also corrects the now-false comment in ci/l1.sh that said no L1 test declares the
scope, and records why the annotation is load-bearing there.
Verified: offline l0,l1,meta --include-scope whole-repo in the pinned toolbox —
25 tests, 0 failures, 0 errors, exit 0.
Co-Authored-By: Claude Opus 5 <[email protected]>
52 lines
2.8 KiB
YAML
52 lines
2.8 KiB
YAML
# =============================================================================
|
|
# L1 RENDERING SCAFFOLD — every namespace renders a default-deny baseline
|
|
# (R-NET-01)
|
|
# Catalog: docs/14 L0/L1 "Every namespace has a default-deny baseline"
|
|
#
|
|
# GIVEN any onboarded service (any namespace),
|
|
# WHEN its resources are rendered,
|
|
# THEN the render includes the namespaced default-deny baseline policy.
|
|
#
|
|
# This is the RENDER-TIME partner of the L2 behavioral default-deny test and of
|
|
# the L0 Kyverno gate (T-0.5). Rendering the baseline is necessary but NOT
|
|
# sufficient — enforcement is proven behaviorally at L2 (R-TEST-01).
|
|
#
|
|
# STATUS: IMPLEMENTED (T-0.3). render-check.sh renders a service and asserts the
|
|
# namespaced default-deny baseline is present + shaped (deny-all, both directions) —
|
|
# a pure offline check (renderer + golden diff, no cluster). conformance/run.sh --layer
|
|
# l1 and ci/l1.sh run it directly; this Chainsaw Test wraps the SAME script so an
|
|
# in-cluster run executes the identical assertion. Rendering != enforcement (proven L2).
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: default-deny-baseline-render
|
|
labels:
|
|
conformance.home.k3s/R-NET-01: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-NET-01"
|
|
conformance.home.k3s/layer: "L1"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
# WHY SCOPE, NOT REQUIREMENTS ALONE: every L1 test exercises ONE shared code path —
|
|
# catalog/render.py against schemas/servicedefinition.schema.json — so anything that changes
|
|
# rendered output breaks these goldens regardless of which requirement the touched path maps to.
|
|
# Requirement-scoped selection cannot see that coupling. Concretely (2026-09-04 external-dns
|
|
# merge): `platform/externaldns/helmrelease.yaml` attributes R-ENV-02, R-OBS-01/02/04,
|
|
# R-STATE-03 and R-TEST-01/02/03/04 via ci/touched-requirements.sh — NOT R-PLAT-02, R-NET-01 or
|
|
# R-NET-05/06/07 — yet it added `external-dns.alpha.kubernetes.io/controller: none` to the
|
|
# rendered output of ALL THREE L1 goldens. A requirement-scoped gate selected ZERO L1 tests, went
|
|
# GREEN, and left every golden stale; the staleness surfaced only on a later full run.
|
|
# ci/l1.sh has passed --include-scope since it was written, waiting for this annotation.
|
|
conformance.home.k3s/scope: "whole-repo"
|
|
conformance.home.k3s/intent: >-
|
|
Rendering any service's namespace yields a default-deny baseline policy.
|
|
spec:
|
|
steps:
|
|
- name: render-and-assert-default-deny
|
|
description: >-
|
|
Render a service and assert the namespaced default-deny baseline is present and
|
|
shaped (deny-all ingress, both Ingress+Egress), matching the golden.
|
|
try:
|
|
- script:
|
|
content: bash ./render-check.sh
|