jakman85andClaude Opus 4.8
a79f24f75e
The renderer's PaaS path (kind: container) had no verifying conformance test — the R-PLAT-02 token appears only in renderer comments, so a change touching catalog/ surfaced it as an uncovered touched-requirement (blocking the merge gate). Adds the container render analog of vm-lifecycle (R-PLAT-03): asserts a kind: container ServiceDefinition renders a Deployment (running the declared image) + a Service, with the egress-class/auth-mode labels admission requires. Offline render-check.sh, wrapped by a chainsaw Test for in-cluster runs. Co-Authored-By: Claude Opus 4.8 <[email protected]>
37 lines
1.7 KiB
YAML
37 lines
1.7 KiB
YAML
# =============================================================================
|
|
# L1 RENDERING — kind: container renders the PaaS workload (R-PLAT-02)
|
|
# Catalog: docs/13 `kind: container` (PaaS default). The render analog of the
|
|
# vm-lifecycle (R-PLAT-03) test for the container path.
|
|
#
|
|
# GIVEN a kind: container ServiceDefinition,
|
|
# WHEN the renderer produces resources,
|
|
# THEN it renders a Deployment (the container workload) + a Service, matching the
|
|
# golden, with the egress-class + auth-mode labels admission requires.
|
|
#
|
|
# STATUS: IMPLEMENTED (T-0.3). render-check.sh is a pure offline check (renderer +
|
|
# golden diff + structural asserts, no cluster). conformance/run.sh --layer l1 and
|
|
# ci/l1.sh run it directly; this Chainsaw Test wraps the SAME script so an in-cluster
|
|
# run executes the identical assertion. Rendering != enforcement (behavior at L2).
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: container-workload-render
|
|
labels:
|
|
conformance.home.k3s/R-PLAT-02: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-PLAT-02"
|
|
conformance.home.k3s/layer: "L1"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/intent: >-
|
|
A kind: container ServiceDefinition renders a Deployment + Service (the PaaS path).
|
|
spec:
|
|
steps:
|
|
- name: render-and-assert-container-workload
|
|
description: >-
|
|
Render a container ServiceDefinition and assert it produces a Deployment running
|
|
the declared image plus a Service, with the required pod labels, matching golden.
|
|
try:
|
|
- script:
|
|
content: bash ./render-check.sh
|