jakman85andClaude Opus 4.8
e0c5c58710
Every chainsaw `check` used the regex operator `=~` (`($stdout =~ 'X'): true`),
which chainsaw's expression engine rejects ('SyntaxError: Unknown char: ~') — so
EVERY such test failed on the assertion even when the behavior passed. Proven with
data-survival (R-STATE-01): the Longhorn canary genuinely SURVIVED pod destruction
(DATA_SURVIVED_OK) but the test FAILED on the `=~` syntax. Converted all 10 tests to
JMESPath `contains($stdout, 'X')` (data-survival's alternation → contains||contains).
data-survival now PASSES; the other 9 (later-phase components) are syntactically fixed
for when their phases deploy.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
52 lines
2.1 KiB
YAML
52 lines
2.1 KiB
YAML
# =============================================================================
|
|
# L3 FAULT-INJECTION SCAFFOLD — GitOps drift correction (R-GITOPS-03)
|
|
# Catalog: docs/14 "GitOps drift (R-GITOPS-03, L3)"
|
|
#
|
|
# GIVEN a reconciled resource,
|
|
# WHEN it is MUTATED live (out-of-band, simulating drift/click-ops),
|
|
# THEN Flux reverts it to the git-declared state within a bounded window.
|
|
#
|
|
# Fault-injection style: we deliberately corrupt live state and assert the control
|
|
# loop heals it (converges back). `finally` leaves the resource in its declared
|
|
# state regardless of outcome.
|
|
#
|
|
# STATUS: scaffold — needs T-1.4 (Flux bootstrapped) + a reconciled sample resource.
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: gitops-drift
|
|
labels:
|
|
conformance.home.k3s/R-GITOPS-03: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-GITOPS-03"
|
|
conformance.home.k3s/layer: "L3"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/intent: >-
|
|
A live mutation to a reconciled resource is reverted by Flux to git state.
|
|
spec:
|
|
steps:
|
|
- name: given-a-reconciled-resource
|
|
try:
|
|
- script:
|
|
content: 'echo "TODO(T-1.4): pick a Flux-reconciled resource with a known git value"'
|
|
- name: when-mutate-live-out-of-band
|
|
try:
|
|
# FAULT INJECTION: patch the live resource to a value that differs from git.
|
|
- script:
|
|
content: |
|
|
set -euo pipefail
|
|
echo "TODO: kubectl patch the resource to a drifted value (e.g. replicas/annotation)"
|
|
- name: then-flux-reverts-to-git-state
|
|
try:
|
|
- script:
|
|
# Bounded poll: assert the live value returns to the git-declared value.
|
|
content: |
|
|
set -euo pipefail
|
|
echo "TODO: within Flux interval, assert live value == git-declared value"
|
|
echo "DRIFT_REVERTED_OK"
|
|
check: { (contains($stdout, 'DRIFT_REVERTED_OK')): true }
|
|
finally:
|
|
- script:
|
|
content: 'echo "TODO: ensure resource left in git-declared state"'
|