jakman85andClaude Opus 4.8
4a017c590e
Implements the two L1 rendering tests that were failing scaffolds: - egress-class-render (R-NET-05/06/07): renders vpn + internet fixtures, diffs each against a committed golden, asserts the vpn steering label is present on vpn and absent on internet (fail-closed), and that flipping the class changes ONLY the egress path (R-NET-07). This fixes the --requirements R-NET-05 merge gate. - default-deny-baseline-render (R-NET-01): asserts every render carries the namespaced default-deny baseline, shaped deny-all + both directions. Each test carries a pure-offline render-check.sh (renderer + golden diff, no cluster). run.sh runs L1 render checks offline and emits a REAL pass/fail JUnit (docs/14: L1 rendering assertions run in CI without a cluster) instead of skipping L1 with the cluster-gated layers; the chainsaw-test.yaml wrappers invoke the same render-check.sh so an in-cluster run executes the identical assertion. Co-Authored-By: Claude Opus 4.8 <[email protected]>
47 lines
2.3 KiB
YAML
47 lines
2.3 KiB
YAML
# =============================================================================
|
|
# L1 RENDERING SCAFFOLD — egress class renders the kill-switched path
|
|
# (R-NET-05, R-NET-06, R-NET-07)
|
|
# Catalog: docs/14 L1 example "`egress: vpn` renders the kill-switched egress path"
|
|
#
|
|
# L1 verifies the ServiceDefinition -> rendered-resources mapping matches golden
|
|
# expectations, WITHOUT asserting runtime behavior. This is NOT a substitute for
|
|
# the L2/L3 behavior tests (R-TEST-01): rendering the policy != enforcing it.
|
|
#
|
|
# GIVEN a ServiceDefinition with `egress: vpn`,
|
|
# WHEN the renderer produces resources,
|
|
# THEN the output includes the egress-gateway steering + kill-switch construct
|
|
# (and `egress: internet` does NOT), and flipping the class only changes the
|
|
# egress path (R-NET-07), not the workload spec.
|
|
#
|
|
# STATUS: IMPLEMENTED (T-0.3). The render assertion is a pure offline check
|
|
# (render-check.sh: renderer + golden diff, no cluster). conformance/run.sh --layer l1
|
|
# and ci/l1.sh run render-check.sh directly WITHOUT a cluster (docs/14: "L1 rendering
|
|
# assertions run in CI without a cluster"). This Chainsaw Test wraps the SAME
|
|
# render-check.sh in a script step so an in-cluster Chainsaw run executes the identical
|
|
# assertion — rendering the policy, NOT enforcing it (enforcement is proven at L2/L3).
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: egress-class-render
|
|
labels:
|
|
conformance.home.k3s/R-NET-05: "true"
|
|
conformance.home.k3s/R-NET-06: "true"
|
|
conformance.home.k3s/R-NET-07: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-NET-05, R-NET-06, R-NET-07"
|
|
conformance.home.k3s/layer: "L1"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/intent: >-
|
|
egress: vpn renders the egress-gateway + kill-switch path; internet does not.
|
|
spec:
|
|
steps:
|
|
- name: render-and-assert-egress-class
|
|
description: >-
|
|
Render the vpn + internet fixtures and assert: each matches its golden; the vpn
|
|
render carries the egress-class=vpn steering label and internet does not; and the
|
|
two renders differ ONLY in the egress-class value (R-NET-07).
|
|
try:
|
|
- script:
|
|
content: bash ./render-check.sh
|