home-network-k3s-impl/conformance/tests/l2-behavioral/default-deny/chainsaw-test.yaml

# =============================================================================
# L2 BEHAVIORAL — Default-deny east-west  (R-NET-01)   [RUNNABLE]
# Catalog: docs/14-testing-and-conformance.md "Default-deny (R-NET-01)"
# Spec:    docs/03-networking-isolation-and-egress.md "Default-deny baseline"
#
# EXEMPLAR: this file is the reference for the tagging convention and step
# style. Other scaffolds follow the same shape (see tests/README.md).
#
# GIVEN a fresh workload in a namespace with the default-deny baseline applied,
# WHEN  it attempts any in-cluster connection except DNS,
# THEN  the connection FAILS (fail-closed); DNS still succeeds.
#
# This asserts observable BEHAVIOR (a probe Job cannot connect) via ephemeral
# probe pods, not the mere existence of a policy object (R-TEST-01).
#
# RUNNABLE ON THE BASE CLUSTER: the platform-wide default-deny baseline (T-2.2)
# is not yet applied cluster-wide, so this test applies an equivalent baseline
# as its OWN hermetic fixture in the per-test namespace. The fixture is a
# standard Kubernetes NetworkPolicy (Cilium enforces it) — portable and
# version-agnostic; the platform's baseline will be the CiliumNetworkPolicy
# equivalent, but the asserted BEHAVIOR (DNS-only egress) is identical, which
# is what R-TEST-01 requires us to prove. Chainsaw auto-creates/cleans the
# namespace (hermetic); the probe Jobs are ephemeral and self-cleaned with it.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: default-deny
  labels:
    # --- requirement tags (authoritative; one label per verified R-* ID) ---
    conformance.home.k3s/R-NET-01: "true"
  annotations:
    conformance.home.k3s/requirements: "R-NET-01"
    conformance.home.k3s/layer: "L2"
    conformance.home.k3s/safety-critical: "false"
    # executable => this test runs real behavior against a cluster (not a scaffold).
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      Given a bare workload in a namespace with the default-deny baseline, only
      DNS egress succeeds; every other in-cluster connection is denied.
spec:
  steps:
    # -- GIVEN: apply the default-deny baseline to the per-test namespace. Deny all
    #    ingress + egress for every pod; allow ONLY DNS egress to the in-cluster
    #    resolver. This is the hermetic stand-in for the platform baseline (T-2.2).
    - name: given-default-deny-baseline
      try:
        - apply:
            resource:
              apiVersion: networking.k8s.io/v1
              kind: NetworkPolicy
              metadata:
                name: default-deny-baseline
              spec:
                podSelector: {}
                policyTypes: [Ingress, Egress]
                # no ingress rules => deny all ingress
                ingress: []
                # only DNS egress to kube-dns (CoreDNS) in kube-system
                egress:
                  - to:
                      - namespaceSelector:
                          matchLabels:
                            kubernetes.io/metadata.name: kube-system
                        podSelector:
                          matchLabels:
                            k8s-app: kube-dns
                    ports:
                      - protocol: UDP
                        port: 53
                      - protocol: TCP
                        port: 53

    # -- THEN(DNS allowed): DNS egress MUST succeed even under default-deny. An
    #    ephemeral Job resolves an in-cluster name; we assert the Job SUCCEEDS.
    #    (Chainsaw polls the Job status within the assert timeout — bounded, no sleeps.)
    - name: then-dns-succeeds
      try:
        - apply:
            resource:
              apiVersion: batch/v1
              kind: Job
              metadata:
                name: dns-probe
              spec:
                backoffLimit: 4
                activeDeadlineSeconds: 120
                template:
                  metadata:
                    labels: { app: conformance-probe }
                  spec:
                    restartPolicy: Never
                    containers:
                      - name: probe
                        image: busybox:1.36.1
                        command:
                          - sh
                          - -c
                          - |
                            set -eu
                            # DNS is the one egress the baseline permits.
                            nslookup kubernetes.default.svc.cluster.local
                            echo DNS_OK
        - assert:
            resource:
              apiVersion: batch/v1
              kind: Job
              metadata: { name: dns-probe }
              status: { succeeded: 1 }

    # -- THEN(everything else denied): a non-DNS in-cluster connection MUST fail
    #    closed. The Job attempts to reach the kube-apiserver ClusterIP (always
    #    present) on 443; the probe EXITS 0 only when that connection is BLOCKED,
    #    so a green Job proves the deny. A leak (connection succeeds) fails the Job.
    - name: then-nondns-denied
      try:
        - apply:
            resource:
              apiVersion: batch/v1
              kind: Job
              metadata:
                name: block-probe
              spec:
                backoffLimit: 4
                activeDeadlineSeconds: 120
                template:
                  metadata:
                    labels: { app: conformance-probe }
                  spec:
                    restartPolicy: Never
                    containers:
                      - name: probe
                        image: busybox:1.36.1
                        command:
                          - sh
                          - -c
                          - |
                            set -u
                            # DNS resolves (allowed); the TCP connect must be dropped.
                            if nc -w 4 kubernetes.default.svc.cluster.local 443 </dev/null 2>/dev/null; then
                              echo "LEAK: reached kube-apiserver under default-deny" 1>&2
                              exit 1
                            fi
                            echo DENIED_OK
        - assert:
            resource:
              apiVersion: batch/v1
              kind: Job
              metadata: { name: block-probe }
              status: { succeeded: 1 }
      # -- chainsaw deletes the namespace (policy + probe Jobs) automatically; this
      #    block is the explicit hook for any out-of-namespace fixtures (none here).
      finally:
        - script:
            content: 'echo "cleanup handled by chainsaw namespace teardown"'
    # -----------------------------------------------------------------------------------
    # PROOF-OF-PASS SENTINEL (R-SEC-03). Every step above is an assert/Job-status gate, so
    # chainsaw already fails the test before reaching this step if any of them fails — but a
    # green Chainsaw JUnit carries NO stdout, and the L2/L3 tests in this suite can self-skip
    # GREEN, so lib/record_run.py refuses to treat a bare `passed` as evidence and records
    # `unknown-no-sentinel-declared` instead. Without a declared token this test could pass
    # forever and NEVER become a recorded proof of R-NET-01 — the isolation half of docs/07's audit proof list
    # — which is precisely what docs/07 asks for ("These proofs are part of the platform
    # acceptance suite, not one-time checks"). This step exists only to emit that token, and it
    # is reached only when everything above has passed. Asserted by
    # tests/l0-static/auditability-proofs-producible.
    - name: then-emit-the-proof-of-pass-sentinel
      try:
        - script:
            content: echo DEFAULT_DENY_PROVEN_OK
            check:
              (contains($stdout, 'DEFAULT_DENY_PROVEN_OK')): true