jakman85andClaude Opus 4.8
9d8e03892f
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
33 lines
1.9 KiB
Markdown
33 lines
1.9 KiB
Markdown
# In-cluster conformance Job (L2/L3)
|
|
|
|
Per **ADR-0011** and **docs/14 "Where each layer runs"**: L0/L1 run in CI without a
|
|
cluster, but **L2 behavioral and L3 fault-injection run as an in-cluster Chainsaw Job**
|
|
on the dev/test cluster that **CI triggers and waits for**. CI holds **no** cluster
|
|
credentials — the Job's own scoped ServiceAccount does (R-SEC-02).
|
|
|
|
## Files
|
|
- `rbac.yaml` — the `conformance` namespace, the `conformance-runner` ServiceAccount, and
|
|
a **least-privilege ClusterRole skeleton**. Rules start **empty** and are added — each
|
|
commented with the test/requirement that needs it — only as the matching fault-injection
|
|
test lands. This is a **privileged test identity**: never reused by workloads, its own
|
|
audit item.
|
|
- `chainsaw-job.yaml` — the Job skeleton. Single entrypoint `./run.sh`; CI sets `args` to
|
|
`--requirements <touched IDs>` (merge gate) or `--layer all --strict-coverage` (phase
|
|
exit). Image pinned to `versions.env` `CHAINSAW_IMAGE`.
|
|
|
|
## Flow
|
|
1. CI (Gitea Actions, delivered in T-6.1b) creates a Job from `chainsaw-job.yaml` (via a
|
|
trigger with narrow rights: create Job + read its logs/status — *not* a broad
|
|
kubeconfig).
|
|
2. The Job clones/loads the impl repo at the commit under test into `/workspace` and runs
|
|
`./run.sh` under `conformance-runner`.
|
|
3. `run.sh` runs Chainsaw over the selected tests and writes `report.junit.xml` +
|
|
`coverage/` to the results volume (`/workspace/conformance/_artifacts`).
|
|
4. CI collects those artifacts (results volume or the terminating log stream, which echoes
|
|
their paths) and enforces the merge / phase-exit gate on them.
|
|
|
|
## Phase 0
|
|
No cluster exists, so nothing here is applied yet. These manifests are reconciled by Flux
|
|
from Phase 1+ and first exercised when L2/L3 can run (T-3.0 onward). In Phase 0 the same
|
|
`run.sh` runs in CI's no-cluster stage and emits a **skipped** JUnit + the coverage report.
|