jakman85andClaude Opus 5.5
8cd5ab2e41
Add R-DNS-04, R-DNS-05 and R-SEC-04 to the requirement mirror and tag the L0 tests that verify them. Align the R-ENV and R-UPD-02 summaries with the amended requirements. Point the VPN egress docs at ADR-0020; the drafted "ADR-0016" number went to the Cloudflare Tunnel. Co-Authored-By: Claude Opus 5.5 <[email protected]>
47 lines
2.6 KiB
YAML
47 lines
2.6 KiB
YAML
# =============================================================================
|
|
# L0 STATIC — PiHole answers an explicit LAN name list, and no LAN-only name is left out of it
|
|
# Catalog: docs/14 L0 row ("Pre-apply, in CI") — runs WITHOUT a cluster.
|
|
#
|
|
# Since PR #156 every public name is a proxied CNAME to the Cloudflare Tunnel and works from the
|
|
# LAN, so PiHole's zone wildcard was replaced by an explicit list (catalog/pihole.yaml). That makes
|
|
# the list load-bearing: a route disowned from public DNS and absent from it resolves nowhere. This
|
|
# test derives the required names from the tree (every `controller: none` HTTPRoute, every hostname
|
|
# the tunnel 404s, the L4 Services' own VIPs) and asserts the list covers them, carries no
|
|
# zone-wide entry, and pins gitea and nextcloud to the Gateway VIP. It proves itself non-vacuous by
|
|
# mutation. Rationale and the honest NOT-proven list: check.sh.
|
|
#
|
|
# WHY SCOPE, NOT REQUIREMENTS: the property spans catalog/, apps/, platform/ and runbooks/; a new
|
|
# internal service in any of them can break it, and ci/touched-requirements.sh maps apps/* to no
|
|
# requirement at all, so a requirement-scoped selection would skip it on precisely those changes.
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: pihole-lan-names
|
|
labels:
|
|
conformance.home.k3s/R-DNS-03: "true"
|
|
conformance.home.k3s/R-DNS-04: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-DNS-03, R-DNS-04"
|
|
conformance.home.k3s/layer: "L0"
|
|
conformance.home.k3s/scope: "whole-repo"
|
|
conformance.home.k3s/safety-critical: "true"
|
|
conformance.home.k3s/executable: "true"
|
|
conformance.home.k3s/intent: >-
|
|
PiHole answers an explicit list of LAN names rather than the whole zone; every HTTPRoute
|
|
disowned from public DNS has an entry to the Gateway VIP; every hostname the Cloudflare
|
|
Tunnel 404s has an entry, with the L4 names on their own VIPs; and gitea and nextcloud stay
|
|
on the LAN path, off Cloudflare's request-size and timeout limits.
|
|
spec:
|
|
steps:
|
|
- name: assert-pihole-explicit-lan-names
|
|
description: >-
|
|
Parse FTLCONF_misc_dnsmasq_lines from catalog/pihole.yaml and the rendered
|
|
apps/wave-0/pihole.yaml, derive the required names from every `controller: none` HTTPRoute,
|
|
the http_status:404 hostnames in platform/cloudflared/config.yaml and the L4 Services'
|
|
lbipam annotations, assert the list covers them and contains no zone-wide entry, and run
|
|
the evaluator on mutated lists to prove it is not vacuous.
|
|
try:
|
|
- script:
|
|
content: bash ./check.sh
|