jakman85andClaude Opus 4.8
9d8e03892f
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
51 lines
2.2 KiB
YAML
51 lines
2.2 KiB
YAML
# =============================================================================
|
|
# L2 BEHAVIORAL SCAFFOLD — Trusted TLS (R-TLS-01, R-TLS-03)
|
|
# Catalog: docs/14 "Trusted TLS (R-TLS-01/02)"
|
|
#
|
|
# GIVEN any exposed endpoint (including `internal`),
|
|
# WHEN its certificate is inspected from a probe,
|
|
# THEN it is valid, non-self-signed, unexpired, chains to a trusted root.
|
|
# (R-TLS-03: issuance also works for internal-only services.)
|
|
# Renewal-before-expiry (R-TLS-02) is a separate time/fault scenario — see the
|
|
# hands-off / cert-renewal coverage; not asserted here.
|
|
#
|
|
# STATUS: scaffold — needs T-2.4 (cert-manager + LE DNS-01 wildcard).
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: trusted-tls
|
|
labels:
|
|
conformance.home.k3s/R-TLS-01: "true"
|
|
conformance.home.k3s/R-TLS-03: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-TLS-01, R-TLS-03"
|
|
conformance.home.k3s/layer: "L2"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/intent: >-
|
|
Exposed endpoints (incl. internal) present a valid, trusted, unexpired cert.
|
|
spec:
|
|
steps:
|
|
- name: given-exposed-endpoint
|
|
try:
|
|
- script:
|
|
content: 'echo "TODO(T-2.4/T-2.5): a service with a Gateway TLS listener"'
|
|
- name: then-cert-is-trusted-and-valid
|
|
try:
|
|
- script:
|
|
# Inspect from an ephemeral probe using the system trust store (no -k):
|
|
# a self-signed / expired / untrusted cert fails the handshake => rc!=0.
|
|
content: |
|
|
set -euo pipefail
|
|
host="<service>.home.keithjackson.dev" # TODO: real host
|
|
echo | openssl s_client -connect "${host}:443" -servername "${host}" \
|
|
-verify_return_error 2>/dev/null \
|
|
| openssl x509 -noout -issuer -enddate -checkend 0 \
|
|
&& echo TLS_VALID
|
|
# checkend 0 => rc!=0 if already expired; -verify_return_error => trusted chain.
|
|
check: { ($stdout =~ 'TLS_VALID'): true }
|
|
- name: then-internal-only-service-also-has-cert
|
|
try:
|
|
- script:
|
|
content: 'echo "TODO(R-TLS-03): repeat against an internal-only host"'
|