jakman85andClaude Opus 4.8
e20f17b896
R-NET-01 default-deny + R-NET-02 deny-undeclared PASS via run.sh (JUnit+coverage, exit 0). Fixed 3 real bugs found by running them: - chainsaw strict list-matching: assert scalar 'phase: Running' not a conditions[] element. - default-deny blocks the kubelet readiness probe -> drop probes (dest pods just need to run). - chainsaw report path ../_artifacts resolved to repo-root -> fix to _artifacts (was exit 1). - swap agnhost->busybox httpd listeners (cached everywhere; cache-timing-proof). Logged the kubelet-probe finding for WS-NET's T-2.2 default-deny baseline design. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
52 lines
2.1 KiB
YAML
52 lines
2.1 KiB
YAML
# Chainsaw Configuration for the home-k3s conformance suite (ADR-0011).
|
|
# Passed to every invocation via `chainsaw test --config config/chainsaw-config.yaml`
|
|
# so local runs and the in-cluster CI Job behave identically (R-TEST-02).
|
|
#
|
|
# Reproducibility knobs live here, NOT in individual tests, so the whole suite shares
|
|
# one deterministic execution contract:
|
|
# * bounded timeouts (no sleep-and-hope; eventual consistency via polled assert/error)
|
|
# * per-test ephemeral namespace, auto-created and auto-deleted (hermetic, isolated)
|
|
# * a leaked fixture is a failure: del/cleanup timeouts are enforced, skipDelete=false
|
|
apiVersion: chainsaw.kyverno.io/v1alpha2
|
|
kind: Configuration
|
|
metadata:
|
|
name: home-k3s-conformance
|
|
spec:
|
|
# -- Deterministic bounded waits. Eventual consistency is handled by polling within
|
|
# these windows (assert/error retry until deadline), never by fixed sleeps.
|
|
timeouts:
|
|
apply: 90s
|
|
assert: 180s
|
|
error: 60s
|
|
delete: 120s
|
|
cleanup: 120s
|
|
exec: 180s
|
|
|
|
# -- Isolation & parallel-safety: each test gets its own generated namespace so tests
|
|
# never collide and can run concurrently.
|
|
namespace:
|
|
# Unique per test run; prefix makes leaked namespaces obvious in `kubectl get ns`.
|
|
template:
|
|
metadata:
|
|
generateName: chainsaw-conf-
|
|
|
|
# -- Concurrency. Tests are hermetic, so they parallelize safely; keep modest to bound
|
|
# cluster load and keep fault-injection tests from contending.
|
|
execution:
|
|
parallel: 4
|
|
# Fail the whole run if any test leaks a namespace/fixture (reproducibility contract).
|
|
failFast: false
|
|
|
|
# -- Self-cleaning: never skip delete; deletion is part of the pass criteria.
|
|
cleanup:
|
|
skipDelete: false
|
|
|
|
# -- Machine-readable output. run.sh normalizes the emitted file to
|
|
# _artifacts/report.junit.xml and layers the requirement-coverage report on top.
|
|
report:
|
|
format: JUNIT-TEST
|
|
name: chainsaw-report
|
|
# relative to run.sh's CWD (conformance/), which creates this dir; ../_artifacts
|
|
# wrongly resolved to repo-root/_artifacts and made chainsaw exit 1 on report write.
|
|
path: _artifacts
|