jakman85andClaude Opus 4.8
9d8e03892f
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
52 lines
2.4 KiB
YAML
52 lines
2.4 KiB
YAML
# =============================================================================
|
|
# L1 RENDERING SCAFFOLD — egress class renders the kill-switched path
|
|
# (R-NET-05, R-NET-06, R-NET-07)
|
|
# Catalog: docs/14 L1 example "`egress: vpn` renders the kill-switched egress path"
|
|
#
|
|
# L1 verifies the ServiceDefinition -> rendered-resources mapping matches golden
|
|
# expectations, WITHOUT asserting runtime behavior. This is NOT a substitute for
|
|
# the L2/L3 behavior tests (R-TEST-01): rendering the policy != enforcing it.
|
|
#
|
|
# GIVEN a ServiceDefinition with `egress: vpn`,
|
|
# WHEN the renderer produces resources,
|
|
# THEN the output includes the egress-gateway steering + kill-switch construct
|
|
# (and `egress: internet` does NOT), and flipping the class only changes the
|
|
# egress path (R-NET-07), not the workload spec.
|
|
#
|
|
# STATUS: scaffold — needs T-0.3 (renderer contract) + T-3.1/T-3.2 (egress design).
|
|
# Rendering assertions can run without live behavior, but Chainsaw applies to a
|
|
# cluster; until Phase 1 this is skipped by run.sh like every other layer.
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: egress-class-render
|
|
labels:
|
|
conformance.home.k3s/R-NET-05: "true"
|
|
conformance.home.k3s/R-NET-06: "true"
|
|
conformance.home.k3s/R-NET-07: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-NET-05, R-NET-06, R-NET-07"
|
|
conformance.home.k3s/layer: "L1"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/intent: >-
|
|
egress: vpn renders the egress-gateway + kill-switch path; internet does not.
|
|
spec:
|
|
steps:
|
|
- name: given-vpn-servicedefinition-render
|
|
try:
|
|
- script:
|
|
# TODO(T-0.3): invoke the renderer on a fixture ServiceDefinition
|
|
# (egress: vpn) and capture rendered YAML to $RENDER_OUT.
|
|
content: 'echo "TODO: render fixtures/svcdef-egress-vpn.yaml -> rendered.yaml"'
|
|
- name: then-render-contains-killswitched-egress
|
|
try:
|
|
- assert:
|
|
# TODO(T-3.x): assert the rendered set includes the egress-gateway
|
|
# steering + kill-switch construct for a vpn-class workload.
|
|
file: golden/egress-vpn.expected.yaml # TODO: author golden file
|
|
- name: then-internet-render-omits-vpn-path
|
|
try:
|
|
- script:
|
|
content: 'echo "TODO: render egress: internet fixture; assert NO vpn/gateway steer"'
|