jakman85andClaude Opus 4.8
9d8e03892f
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
38 lines
1.5 KiB
YAML
38 lines
1.5 KiB
YAML
# =============================================================================
|
|
# L1 RENDERING SCAFFOLD — every namespace renders a default-deny baseline
|
|
# (R-NET-01)
|
|
# Catalog: docs/14 L0/L1 "Every namespace has a default-deny baseline"
|
|
#
|
|
# GIVEN any onboarded service (any namespace),
|
|
# WHEN its resources are rendered,
|
|
# THEN the render includes the namespaced default-deny baseline policy.
|
|
#
|
|
# This is the RENDER-TIME partner of the L2 behavioral default-deny test and of
|
|
# the L0 Kyverno gate (T-0.5). Rendering the baseline is necessary but NOT
|
|
# sufficient — enforcement is proven behaviorally at L2 (R-TEST-01).
|
|
#
|
|
# STATUS: scaffold — needs T-0.3 (renderer) + T-2.2 (baseline definition).
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: default-deny-baseline-render
|
|
labels:
|
|
conformance.home.k3s/R-NET-01: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-NET-01"
|
|
conformance.home.k3s/layer: "L1"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/intent: >-
|
|
Rendering any service's namespace yields a default-deny baseline policy.
|
|
spec:
|
|
steps:
|
|
- name: given-a-rendered-namespace
|
|
try:
|
|
- script:
|
|
content: 'echo "TODO(T-0.3/T-2.2): render a service; capture namespaced policies"'
|
|
- name: then-render-includes-default-deny
|
|
try:
|
|
- assert:
|
|
file: golden/default-deny-baseline.expected.yaml # TODO: author golden
|