jakman85andClaude Opus 4.8
9d8e03892f
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
61 lines
2.6 KiB
YAML
61 lines
2.6 KiB
YAML
# =============================================================================
|
|
# L2 BEHAVIORAL SCAFFOLD — Egress class (R-NET-05, R-NET-07)
|
|
# Catalog: docs/14 "Egress class (R-NET-05)" + "Egress flip (R-NET-07)"
|
|
#
|
|
# GIVEN one `egress: internet` and one `egress: vpn` workload,
|
|
# WHEN each queries an external echo of its own public IP,
|
|
# THEN internet shows the home/WAN IP and vpn shows the VPN (PIA) IP.
|
|
# AND (R-NET-07) flipping the class in git re-routes with no workload rewrite.
|
|
#
|
|
# STATUS: scaffold — needs T-3.1/T-3.2 (egress gateway + PIA/Gluetun).
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: egress-class
|
|
labels:
|
|
conformance.home.k3s/R-NET-05: "true"
|
|
conformance.home.k3s/R-NET-07: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-NET-05, R-NET-07"
|
|
conformance.home.k3s/layer: "L2"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/intent: >-
|
|
internet-class egress shows WAN IP; vpn-class shows VPN IP; git flip re-routes.
|
|
spec:
|
|
steps:
|
|
- name: given-two-egress-classes
|
|
try:
|
|
- apply:
|
|
file: fixtures/internet-and-vpn-pods.yaml # TODO(T-3.1): author fixtures
|
|
- name: then-internet-shows-wan-ip
|
|
try:
|
|
- script:
|
|
# external echo of public IP; assert it is NOT the known VPN egress range.
|
|
content: |
|
|
set -euo pipefail
|
|
ip=$(kubectl -n "$NAMESPACE" exec egress-internet -- \
|
|
curl -fsS https://api.ipify.org)
|
|
echo "internet_ip=$ip"
|
|
# TODO: assert ip is in home/WAN set, not the PIA range.
|
|
check: { ($stdout =~ 'internet_ip='): true }
|
|
- name: then-vpn-shows-vpn-ip
|
|
try:
|
|
- script:
|
|
content: |
|
|
set -euo pipefail
|
|
ip=$(kubectl -n "$NAMESPACE" exec egress-vpn -- \
|
|
curl -fsS https://api.ipify.org)
|
|
echo "vpn_ip=$ip"
|
|
# TODO: assert ip is a PIA egress address (distinct from WAN IP).
|
|
check: { ($stdout =~ 'vpn_ip='): true }
|
|
- name: when-flip-egress-class-in-git
|
|
try:
|
|
- script:
|
|
# R-NET-07: patch the egress class (simulating a git/Flux change) and
|
|
# assert the observed egress path changes with NO pod recreation.
|
|
content: |
|
|
set -euo pipefail
|
|
echo "TODO(T-3.4): patch egress class, reconcile, re-check public IP,"
|
|
echo "assert path changed and pod UID/generation unchanged (no rewrite)."
|