jakman85andClaude Opus 4.8
4a017c590e
Implements the two L1 rendering tests that were failing scaffolds: - egress-class-render (R-NET-05/06/07): renders vpn + internet fixtures, diffs each against a committed golden, asserts the vpn steering label is present on vpn and absent on internet (fail-closed), and that flipping the class changes ONLY the egress path (R-NET-07). This fixes the --requirements R-NET-05 merge gate. - default-deny-baseline-render (R-NET-01): asserts every render carries the namespaced default-deny baseline, shaped deny-all + both directions. Each test carries a pure-offline render-check.sh (renderer + golden diff, no cluster). run.sh runs L1 render checks offline and emits a REAL pass/fail JUnit (docs/14: L1 rendering assertions run in CI without a cluster) instead of skipping L1 with the cluster-gated layers; the chainsaw-test.yaml wrappers invoke the same render-check.sh so an in-cluster run executes the identical assertion. Co-Authored-By: Claude Opus 4.8 <[email protected]>
41 lines
1.9 KiB
YAML
41 lines
1.9 KiB
YAML
# =============================================================================
|
|
# L1 RENDERING SCAFFOLD — every namespace renders a default-deny baseline
|
|
# (R-NET-01)
|
|
# Catalog: docs/14 L0/L1 "Every namespace has a default-deny baseline"
|
|
#
|
|
# GIVEN any onboarded service (any namespace),
|
|
# WHEN its resources are rendered,
|
|
# THEN the render includes the namespaced default-deny baseline policy.
|
|
#
|
|
# This is the RENDER-TIME partner of the L2 behavioral default-deny test and of
|
|
# the L0 Kyverno gate (T-0.5). Rendering the baseline is necessary but NOT
|
|
# sufficient — enforcement is proven behaviorally at L2 (R-TEST-01).
|
|
#
|
|
# STATUS: IMPLEMENTED (T-0.3). render-check.sh renders a service and asserts the
|
|
# namespaced default-deny baseline is present + shaped (deny-all, both directions) —
|
|
# a pure offline check (renderer + golden diff, no cluster). conformance/run.sh --layer
|
|
# l1 and ci/l1.sh run it directly; this Chainsaw Test wraps the SAME script so an
|
|
# in-cluster run executes the identical assertion. Rendering != enforcement (proven L2).
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: default-deny-baseline-render
|
|
labels:
|
|
conformance.home.k3s/R-NET-01: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-NET-01"
|
|
conformance.home.k3s/layer: "L1"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/intent: >-
|
|
Rendering any service's namespace yields a default-deny baseline policy.
|
|
spec:
|
|
steps:
|
|
- name: render-and-assert-default-deny
|
|
description: >-
|
|
Render a service and assert the namespaced default-deny baseline is present and
|
|
shaped (deny-all ingress, both Ingress+Egress), matching the golden.
|
|
try:
|
|
- script:
|
|
content: bash ./render-check.sh
|