jakman85andClaude Opus 4.8
9d8e03892f
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
71 lines
3.1 KiB
YAML
71 lines
3.1 KiB
YAML
# =============================================================================
|
|
# L3 FAULT-INJECTION SCAFFOLD — VPN kill-switch (R-NET-06) *SAFETY-CRITICAL*
|
|
# Catalog: docs/14 "VPN kill-switch (R-NET-06, L3)"; ADR-0013 (PIA/Gluetun).
|
|
#
|
|
# GIVEN a `vpn`-class workload with a HEALTHY tunnel,
|
|
# WHEN the tunnel is FORCED DOWN (fault injection),
|
|
# THEN the workload has ZERO egress to the plain internet (fail-closed), and
|
|
# `internet`-class workloads are UNAFFECTED;
|
|
# WHEN the tunnel recovers, THEN connectivity returns.
|
|
#
|
|
# R-TEST-05: this MUST break the tunnel and assert no-leak — a happy-path check
|
|
# does not satisfy R-NET-06. `finally` ALWAYS restores the tunnel so a failure
|
|
# mid-test never leaves the gateway down (self-healing fixture).
|
|
#
|
|
# STATUS: scaffold — needs T-3.0 (fault harness) + T-3.2 (Gluetun gateway).
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: vpn-killswitch
|
|
labels:
|
|
conformance.home.k3s/R-NET-06: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-NET-06"
|
|
conformance.home.k3s/layer: "L3"
|
|
conformance.home.k3s/safety-critical: "true"
|
|
conformance.home.k3s/intent: >-
|
|
Tunnel down => vpn workload leaks nothing; internet workloads unaffected;
|
|
recovery restores connectivity.
|
|
spec:
|
|
steps:
|
|
- name: given-healthy-tunnel-and-two-workloads
|
|
try:
|
|
- apply:
|
|
file: fixtures/vpn-and-internet-pods.yaml # TODO(T-3.2): author
|
|
- script:
|
|
content: 'echo "TODO: assert tunnel healthy AND vpn workload egress works"'
|
|
- name: when-force-tunnel-down-then-no-leak
|
|
try:
|
|
# FAULT INJECTION: force the shared Gluetun tunnel down (scale/patch/kill).
|
|
- script:
|
|
content: |
|
|
set -euo pipefail
|
|
echo "TODO(T-3.0): scale gluetun to 0 / drop wg iface (force tunnel DOWN)"
|
|
- script:
|
|
# THEN: vpn workload must reach NOTHING on the plain internet.
|
|
content: |
|
|
set -euo pipefail
|
|
if kubectl -n "$NAMESPACE" exec egress-vpn -- \
|
|
curl -fsS --max-time 5 https://api.ipify.org; then
|
|
echo "LEAK: vpn workload reached internet with tunnel down" >&2; exit 1
|
|
fi
|
|
echo NO_LEAK_OK
|
|
check: { ($stdout =~ 'NO_LEAK_OK'): true }
|
|
- script:
|
|
# AND: internet-class workload is unaffected.
|
|
content: |
|
|
set -euo pipefail
|
|
kubectl -n "$NAMESPACE" exec egress-internet -- \
|
|
curl -fsS --max-time 5 https://api.ipify.org && echo INTERNET_UNAFFECTED_OK
|
|
check: { ($stdout =~ 'INTERNET_UNAFFECTED_OK'): true }
|
|
- name: when-tunnel-recovers-connectivity-returns
|
|
try:
|
|
- script:
|
|
content: 'echo "TODO(T-3.0): restore gluetun; assert vpn egress returns"'
|
|
# ALWAYS restore the tunnel, even if an assertion above failed.
|
|
finally:
|
|
- script:
|
|
content: |
|
|
echo "TODO(T-3.0): guarantee gluetun scaled back / wg iface restored"
|