jakman85andClaude Opus 4.8
20de78f5eb
Phase-2 exit tests (were Phase-0 scaffolds), authored against the live platform:
- trusted-tls (R-TLS-01/03): in-cluster probe dials the gateway Service (env-agnostic
via --connect-to) with wildcard SNI and verifies the served cert CHAINS TO THE LE
STAGING ROOT (operator decision A; dev uses LE-staging per ADR-0006). Fixture embeds
the '(STAGING) Pretend Pear X1' root. Probes public + internal-only hostnames (R-TLS-03).
PASSES.
- dns-exposure (R-DNS-02): a LoadBalancer Service with an external-dns hostname; polls
public DNS until ExternalDNS auto-publishes the record; teardown + policy=sync removes it.
ExternalDNS fix (root cause of the DNS test): domain-filter was the platform SUBDOMAIN
home.keithjackson.dev, which filters OUT the actual Cloudflare zone keithjackson.dev
('no hosted zone matching record DNS Name' — record generated but skipped). Add a
DNS_ZONE cluster-var (keithjackson.dev) and set domainFilters to it. policy=sync +
txt-registry still only manage ExternalDNS-owned records (the pre-existing wildcard is
untouched). Resolves the file's WS-NET R-DNS-02 TODO.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
95 lines
4.5 KiB
YAML
95 lines
4.5 KiB
YAML
# =============================================================================
|
|
# L2 BEHAVIORAL — Trusted TLS (R-TLS-01, R-TLS-03) [RUNNABLE]
|
|
# Catalog: docs/14 "Trusted TLS (R-TLS-01/02)"
|
|
# Spec: docs/09 (Gateway API + DNS-01 wildcard), ADR-0006 (LE issuers)
|
|
#
|
|
# GIVEN the shared Gateway terminating TLS with the cert-manager wildcard cert,
|
|
# WHEN a probe dials it (SNI *.home.keithjackson.dev) and verifies the chain,
|
|
# THEN the served cert is non-self-signed, unexpired, covers the wildcard SAN,
|
|
# and CHAINS TO A REAL CA ROOT (R-TLS-01). The wildcard SAN also covers
|
|
# internal-only hostnames, so internal services get the same trusted cert
|
|
# (R-TLS-03).
|
|
#
|
|
# TRUST MODEL (operator decision "A", DECISIONS-LOG): dev issues from Let's
|
|
# Encrypt **STAGING** (ADR-0006, to avoid prod rate limits) — a real CA, but not
|
|
# in the system trust store. So the probe verifies the chain against the LE
|
|
# STAGING root (fixtures/le-staging-root-ca.yaml, "(STAGING) Pretend Pear X1"),
|
|
# which is the faithful "chains to a trusted root" check for this environment.
|
|
# A prod overlay (LE-prod) would verify against the system store instead.
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: trusted-tls
|
|
labels:
|
|
conformance.home.k3s/R-TLS-01: "true"
|
|
conformance.home.k3s/R-TLS-03: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-TLS-01, R-TLS-03"
|
|
conformance.home.k3s/layer: "L2"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/executable: "true"
|
|
conformance.home.k3s/intent: >-
|
|
The shared Gateway serves a valid, unexpired, non-self-signed wildcard cert
|
|
that chains to a real CA root (LE-staging in dev); the wildcard SAN covers
|
|
internal-only hostnames too.
|
|
spec:
|
|
steps:
|
|
- name: given-le-staging-root-trust-anchor
|
|
try:
|
|
- apply:
|
|
file: fixtures/le-staging-root-ca.yaml
|
|
- name: then-gateway-cert-chains-to-trusted-root
|
|
try:
|
|
- apply:
|
|
resource:
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: tls-probe
|
|
spec:
|
|
backoffLimit: 4
|
|
activeDeadlineSeconds: 120
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
volumes:
|
|
- name: ca
|
|
configMap:
|
|
name: le-staging-root
|
|
containers:
|
|
- name: probe
|
|
image: curlimages/curl:8.11.1
|
|
volumeMounts:
|
|
- name: ca
|
|
mountPath: /ca
|
|
readOnly: true
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -eu
|
|
gw="cilium-gateway-shared.gateway.svc.cluster.local"
|
|
# Probe TWO wildcard hostnames — one "public", one "internal-only". Both
|
|
# match *.home.keithjackson.dev, so a clean verify against the LE-staging
|
|
# root for BOTH proves R-TLS-01 (chains to a real CA root) AND R-TLS-03
|
|
# (the same trusted wildcard covers internal-only names).
|
|
# --connect-to sends SNI/Host=$host but DIALS the gateway Service by name
|
|
# (env-agnostic — no hardcoded VIP). curl (no -f) exits 0 on the gateway's
|
|
# 404 once TLS+hostname verify; it exits 60 if the chain/hostname fails
|
|
# (verified empirically), so `set -e` + rc=0 is the assertion. TLS
|
|
# terminates at the gateway before HTTP routing, so no backend is needed.
|
|
for host in conformance.home.keithjackson.dev internal-only.home.keithjackson.dev; do
|
|
curl -sS --cacert /ca/root.pem \
|
|
--connect-to "${host}:443:${gw}:443" \
|
|
-o /dev/null "https://${host}/"
|
|
echo "TLS_TRUSTED ${host}"
|
|
done
|
|
echo ALL_TRUSTED
|
|
- assert:
|
|
resource:
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata: { name: tls-probe }
|
|
status: { succeeded: 1 }
|