jakman85andClaude Opus 4.8
20de78f5eb
Phase-2 exit tests (were Phase-0 scaffolds), authored against the live platform:
- trusted-tls (R-TLS-01/03): in-cluster probe dials the gateway Service (env-agnostic
via --connect-to) with wildcard SNI and verifies the served cert CHAINS TO THE LE
STAGING ROOT (operator decision A; dev uses LE-staging per ADR-0006). Fixture embeds
the '(STAGING) Pretend Pear X1' root. Probes public + internal-only hostnames (R-TLS-03).
PASSES.
- dns-exposure (R-DNS-02): a LoadBalancer Service with an external-dns hostname; polls
public DNS until ExternalDNS auto-publishes the record; teardown + policy=sync removes it.
ExternalDNS fix (root cause of the DNS test): domain-filter was the platform SUBDOMAIN
home.keithjackson.dev, which filters OUT the actual Cloudflare zone keithjackson.dev
('no hosted zone matching record DNS Name' — record generated but skipped). Add a
DNS_ZONE cluster-var (keithjackson.dev) and set domainFilters to it. policy=sync +
txt-registry still only manage ExternalDNS-owned records (the pre-existing wildcard is
untouched). Resolves the file's WS-NET R-DNS-02 TODO.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
102 lines
4.4 KiB
YAML
102 lines
4.4 KiB
YAML
# =============================================================================
|
|
# L2 BEHAVIORAL — DNS auto-record / exposure (R-DNS-02) [RUNNABLE]
|
|
# Catalog: docs/14 "DNS/exposure (R-DNS-*)"
|
|
# Spec: docs/09 (ExternalDNS auto-manages records; split-horizon foundation)
|
|
#
|
|
# GIVEN a LoadBalancer Service annotated with an external-dns hostname,
|
|
# WHEN ExternalDNS reconciles (source=service, provider=cloudflare, policy=sync),
|
|
# THEN a PUBLIC DNS record for that hostname is auto-created, pointing at the
|
|
# Service's Cilium-assigned LB IP (R-DNS-02). The record resolves to the
|
|
# cluster LB IP (10.73.0.240-.250), i.e. clients reach the cluster endpoint.
|
|
#
|
|
# CLEANUP: chainsaw deletes the per-test namespace (Service included) at teardown;
|
|
# ExternalDNS policy=sync then REMOVES the record from Cloudflare on its next pass.
|
|
# This test creates a real record in the live keithjackson.dev zone (operator-approved).
|
|
#
|
|
# SCOPE: asserts R-DNS-02 (auto-managed record appears) concretely. R-DNS-01/03
|
|
# (split-horizon internal-vs-external resolution) need the internal resolver and
|
|
# are covered separately.
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: dns-exposure
|
|
labels:
|
|
conformance.home.k3s/R-DNS-02: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-DNS-02"
|
|
conformance.home.k3s/layer: "L2"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/executable: "true"
|
|
conformance.home.k3s/intent: >-
|
|
A LoadBalancer Service annotated with an external-dns hostname gets a public
|
|
DNS record auto-created by ExternalDNS (Cloudflare), resolving to its LB IP.
|
|
spec:
|
|
# ExternalDNS reconcile + Cloudflare propagation can take a couple of minutes;
|
|
# widen the assert/exec windows for this test only.
|
|
timeouts:
|
|
apply: 90s
|
|
assert: 5m
|
|
exec: 6m
|
|
steps:
|
|
- name: given-a-service-requesting-a-dns-name
|
|
try:
|
|
- apply:
|
|
resource:
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: dns-probe-svc
|
|
annotations:
|
|
external-dns.alpha.kubernetes.io/hostname: conformance-dns.home.keithjackson.dev
|
|
spec:
|
|
type: LoadBalancer
|
|
# No real backend needed — Cilium LB-IPAM assigns a VIP regardless, and
|
|
# ExternalDNS creates the record from the Service's LB IP + annotation.
|
|
selector:
|
|
app: dns-probe-no-such-backend
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
targetPort: 80
|
|
- name: then-externaldns-creates-the-public-record
|
|
try:
|
|
- apply:
|
|
resource:
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: dns-verify
|
|
spec:
|
|
backoffLimit: 2
|
|
activeDeadlineSeconds: 330
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: probe
|
|
image: busybox:1.36.1
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -u
|
|
host="conformance-dns.home.keithjackson.dev"
|
|
# Poll PUBLIC DNS (1.1.1.1) until the auto-created A record appears and
|
|
# points into the cluster LB range 10.73.0.24x. Proves ExternalDNS created it.
|
|
for i in $(seq 1 28); do
|
|
ip="$(nslookup "$host" 1.1.1.1 2>/dev/null | grep -oE '10\.73\.0\.[0-9]+' | head -1)"
|
|
if [ -n "$ip" ]; then echo "RECORD_FOUND $host -> $ip"; exit 0; fi
|
|
echo "poll $i: record not yet published"; sleep 10
|
|
done
|
|
echo "FAIL: ExternalDNS did not publish the record within timeout"; exit 1
|
|
- assert:
|
|
resource:
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata: { name: dns-verify }
|
|
status: { succeeded: 1 }
|
|
finally:
|
|
- script:
|
|
content: 'echo "teardown: chainsaw deletes the namespace/Service; ExternalDNS policy=sync removes the Cloudflare record"'
|