jakman85andClaude Opus 4.8
9d8e03892f
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
54 lines
2.2 KiB
YAML
54 lines
2.2 KiB
YAML
# =============================================================================
|
|
# L2 BEHAVIORAL SCAFFOLD — DNS / exposure (R-DNS-01, R-DNS-02, R-DNS-03)
|
|
# Catalog: docs/14 "DNS/exposure (R-DNS-*)"
|
|
#
|
|
# GIVEN a service,
|
|
# WHEN it is resolved,
|
|
# THEN the record exists (auto-managed) and internal clients hit the internal
|
|
# Gateway; an `internal` service is unreachable publicly while a `public`
|
|
# service is reachable + TLS-valid.
|
|
#
|
|
# STATUS: scaffold — needs T-2.5 (ExternalDNS + Gateway + split-horizon PiHole).
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: dns-exposure
|
|
labels:
|
|
conformance.home.k3s/R-DNS-01: "true"
|
|
conformance.home.k3s/R-DNS-02: "true"
|
|
conformance.home.k3s/R-DNS-03: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-DNS-01, R-DNS-02, R-DNS-03"
|
|
conformance.home.k3s/layer: "L2"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/intent: >-
|
|
Record auto-appears; internal clients resolve to the internal Gateway;
|
|
internal is not public, public is reachable + TLS-valid.
|
|
spec:
|
|
steps:
|
|
- name: given-a-declared-service
|
|
try:
|
|
- script:
|
|
content: 'echo "TODO(T-2.5): onboard a service via ServiceDefinition"'
|
|
- name: then-record-exists-auto-managed
|
|
try:
|
|
- script:
|
|
# R-DNS-01/02: the <service>.home.keithjackson.dev record appears with
|
|
# no manual step (ExternalDNS from declared intent).
|
|
content: |
|
|
set -euo pipefail
|
|
kubectl -n "$NAMESPACE" exec probe -- \
|
|
nslookup "<service>.home.keithjackson.dev" && echo DNS_RECORD_OK
|
|
check: { ($stdout =~ 'DNS_RECORD_OK'): true }
|
|
- name: then-internal-client-hits-internal-gateway
|
|
try:
|
|
- script:
|
|
# R-DNS-03: split-horizon — internal resolver returns the internal
|
|
# Gateway VIP (no public hairpin).
|
|
content: 'echo "TODO(T-2.5): assert resolved IP == internal Gateway VIP"'
|
|
- name: then-internal-unreachable-publicly-public-reachable
|
|
try:
|
|
- script:
|
|
content: 'echo "TODO: assert internal not public; public reachable + TLS-valid"'
|