jakman85andClaude Opus 5
b389566641
All three L1 tests now declare `conformance.home.k3s/scope: "whole-repo"`.
ci/l1.sh has passed --include-scope whole-repo since it was written, with a
comment saying no L1 test declared the scope yet and it was wired ahead of time
so the next whole-repo invariant "at any layer" would be picked up by annotation
alone. Nothing ever declared it. The consequence is that the entire L1 rendering
layer only ran when a touched path happened to attribute R-PLAT-02, R-NET-01 or
R-NET-05/06/07 — a fail-open hole for every other change in the repo.
The coupling requirement-scoped selection cannot see is that all three tests
exercise ONE code path: catalog/render.py against
schemas/servicedefinition.schema.json. Anything that changes rendered output
invalidates these goldens no matter which requirement the touched path maps to.
The 2026-09-04 external-dns merge is the proof, measured rather than asserted.
ci/touched-requirements.sh attributes platform/externaldns/helmrelease.yaml to
R-ENV-02, R-OBS-01/02/04, R-STATE-03 and R-TEST-01/02/03/04 — none of the
rendering requirements — yet that change added
external-dns.alpha.kubernetes.io/controller: none
to the rendered output of all three goldens. Via --print-selection:
requirement-scoped only (the 2026-09-04 behaviour): 0 L1 tests selected
with --include-scope whole-repo (how ci/l1.sh runs): 3 L1 tests selected
So the merge gated GREEN while leaving every rendering golden stale, and the
staleness surfaced only on a later full run.
Also corrects the now-false comment in ci/l1.sh that said no L1 test declares the
scope, and records why the annotation is load-bearing there.
Verified: offline l0,l1,meta --include-scope whole-repo in the pinned toolbox —
25 tests, 0 failures, 0 errors, exit 0.
Co-Authored-By: Claude Opus 5 <[email protected]>
48 lines
2.7 KiB
YAML
48 lines
2.7 KiB
YAML
# =============================================================================
|
|
# L1 RENDERING — kind: container renders the PaaS workload (R-PLAT-02)
|
|
# Catalog: docs/13 `kind: container` (PaaS default). The render analog of the
|
|
# vm-lifecycle (R-PLAT-03) test for the container path.
|
|
#
|
|
# GIVEN a kind: container ServiceDefinition,
|
|
# WHEN the renderer produces resources,
|
|
# THEN it renders a Deployment (the container workload) + a Service, matching the
|
|
# golden, with the egress-class + auth-mode labels admission requires.
|
|
#
|
|
# STATUS: IMPLEMENTED (T-0.3). render-check.sh is a pure offline check (renderer +
|
|
# golden diff + structural asserts, no cluster). conformance/run.sh --layer l1 and
|
|
# ci/l1.sh run it directly; this Chainsaw Test wraps the SAME script so an in-cluster
|
|
# run executes the identical assertion. Rendering != enforcement (behavior at L2).
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: container-workload-render
|
|
labels:
|
|
conformance.home.k3s/R-PLAT-02: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-PLAT-02"
|
|
conformance.home.k3s/layer: "L1"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
# WHY SCOPE, NOT REQUIREMENTS ALONE: every L1 test exercises ONE shared code path —
|
|
# catalog/render.py against schemas/servicedefinition.schema.json — so anything that changes
|
|
# rendered output breaks these goldens regardless of which requirement the touched path maps to.
|
|
# Requirement-scoped selection cannot see that coupling. Concretely (2026-09-04 external-dns
|
|
# merge): `platform/externaldns/helmrelease.yaml` attributes R-ENV-02, R-OBS-01/02/04,
|
|
# R-STATE-03 and R-TEST-01/02/03/04 via ci/touched-requirements.sh — NOT R-PLAT-02, R-NET-01 or
|
|
# R-NET-05/06/07 — yet it added `external-dns.alpha.kubernetes.io/controller: none` to the
|
|
# rendered output of ALL THREE L1 goldens. A requirement-scoped gate selected ZERO L1 tests, went
|
|
# GREEN, and left every golden stale; the staleness surfaced only on a later full run.
|
|
# ci/l1.sh has passed --include-scope since it was written, waiting for this annotation.
|
|
conformance.home.k3s/scope: "whole-repo"
|
|
conformance.home.k3s/intent: >-
|
|
A kind: container ServiceDefinition renders a Deployment + Service (the PaaS path).
|
|
spec:
|
|
steps:
|
|
- name: render-and-assert-container-workload
|
|
description: >-
|
|
Render a container ServiceDefinition and assert it produces a Deployment running
|
|
the declared image plus a Service, with the required pod labels, matching golden.
|
|
try:
|
|
- script:
|
|
content: bash ./render-check.sh
|