jakman85andClaude Opus 4.8
9d8e03892f
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
56 lines
2.7 KiB
YAML
56 lines
2.7 KiB
YAML
# =============================================================================
|
|
# L2 BEHAVIORAL SCAFFOLD — Onboarding completeness (WS-APPS; R-GITOPS-02)
|
|
# Catalog: docs/14 "Onboarding completeness (WS-APPS)"
|
|
#
|
|
# GIVEN only a merged ServiceDefinition (no manual steps beyond merge),
|
|
# THEN the service is fully wired: compute + storage + policy + egress + TLS +
|
|
# DNS + monitoring + update — asserted by the UNION of the relevant tests
|
|
# above run against that specific service.
|
|
#
|
|
# This is an AGGREGATE gate: it composes the other behavior tests (default-deny,
|
|
# deny-undeclared, egress-class, trusted-tls, dns-exposure, data-survival,
|
|
# alerting, hands-off-update) scoped to one onboarded service. It maps to
|
|
# R-GITOPS-02 ("onboarding = a versioned catalog change") — the machine-checkable
|
|
# proxy for the WS-APPS "fully wired from ServiceDefinition alone" gate.
|
|
#
|
|
# STATUS: scaffold — meaningful only once the composed tests + a real onboarded
|
|
# service exist (Phase 6, T-6.*).
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: onboarding-completeness
|
|
labels:
|
|
conformance.home.k3s/R-GITOPS-02: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-GITOPS-02"
|
|
conformance.home.k3s/layer: "L2"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/intent: >-
|
|
From a merged ServiceDefinition alone, the service is fully wired with no
|
|
manual step (union of compute/storage/policy/egress/TLS/DNS/obs/update tests).
|
|
conformance.home.k3s/composes: >-
|
|
default-deny, deny-undeclared, egress-class, trusted-tls, dns-exposure,
|
|
data-survival, alerting, hands-off-update
|
|
spec:
|
|
steps:
|
|
- name: given-only-a-merged-servicedefinition
|
|
try:
|
|
- script:
|
|
content: 'echo "TODO(T-6.*): apply ONE ServiceDefinition; perform NO manual steps"'
|
|
- name: then-fully-wired-union-of-behaviors
|
|
try:
|
|
- script:
|
|
# Each line below is a scoped invocation of the corresponding behavior
|
|
# check against the onboarded service; ALL must pass for completeness.
|
|
content: |
|
|
set -euo pipefail
|
|
echo "TODO: assert compute up (pods/VM Running)"
|
|
echo "TODO: assert PVC bound on longhorn/bulk (not ephemeral)"
|
|
echo "TODO: assert default-deny + declared dependencies only"
|
|
echo "TODO: assert egress class as declared"
|
|
echo "TODO: assert DNS record + trusted TLS"
|
|
echo "TODO: assert metrics/logs flowing + alert defined"
|
|
echo "TODO: assert update policy present"
|
|
echo "NO manual step was required beyond git merge"
|