jakman85andClaude Opus 4.8
9d8e03892f
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
49 lines
1.9 KiB
YAML
49 lines
1.9 KiB
YAML
# =============================================================================
|
|
# L2 BEHAVIORAL SCAFFOLD — Explicit allow / deny-undeclared (R-NET-02)
|
|
# Catalog: docs/14 "Explicit allow / deny-undeclared (R-NET-02)"
|
|
#
|
|
# GIVEN a service with declared `dependencies`,
|
|
# WHEN the source reaches a DECLARED dest port -> THEN it succeeds;
|
|
# WHEN the source reaches an UNDECLARED dest -> THEN it fails (negative test).
|
|
#
|
|
# STATUS: scaffold — needs T-2.3 (render dependencies -> CiliumNetworkPolicy).
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: deny-undeclared
|
|
labels:
|
|
conformance.home.k3s/R-NET-02: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-NET-02"
|
|
conformance.home.k3s/layer: "L2"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/intent: >-
|
|
A declared dependency connects; an undeclared destination is blocked.
|
|
spec:
|
|
steps:
|
|
- name: given-source-with-declared-dependency
|
|
try:
|
|
- apply:
|
|
# TODO(T-2.3): apply a ServiceDefinition/rendered policy where `source`
|
|
# declares dependency on `dest:declared-port`; deploy source + two dests.
|
|
file: fixtures/source-and-dests.yaml # TODO: author fixtures
|
|
- name: then-declared-succeeds
|
|
try:
|
|
- script:
|
|
content: |
|
|
set -euo pipefail
|
|
kubectl -n "$NAMESPACE" exec source -- nc -z -w 3 declared-dest 80 \
|
|
&& echo ALLOW_OK
|
|
check: { ($stdout =~ 'ALLOW_OK'): true }
|
|
- name: then-undeclared-denied
|
|
try:
|
|
- script:
|
|
content: |
|
|
set -euo pipefail
|
|
if kubectl -n "$NAMESPACE" exec source -- nc -z -w 3 undeclared-dest 80; then
|
|
echo "LEAK: undeclared destination reachable" >&2; exit 1
|
|
fi
|
|
echo DENY_OK
|
|
check: { ($stdout =~ 'DENY_OK'): true }
|