jakman85andClaude Opus 4.8
4a017c590e
Implements the two L1 rendering tests that were failing scaffolds: - egress-class-render (R-NET-05/06/07): renders vpn + internet fixtures, diffs each against a committed golden, asserts the vpn steering label is present on vpn and absent on internet (fail-closed), and that flipping the class changes ONLY the egress path (R-NET-07). This fixes the --requirements R-NET-05 merge gate. - default-deny-baseline-render (R-NET-01): asserts every render carries the namespaced default-deny baseline, shaped deny-all + both directions. Each test carries a pure-offline render-check.sh (renderer + golden diff, no cluster). run.sh runs L1 render checks offline and emits a REAL pass/fail JUnit (docs/14: L1 rendering assertions run in CI without a cluster) instead of skipping L1 with the cluster-gated layers; the chainsaw-test.yaml wrappers invoke the same render-check.sh so an in-cluster run executes the identical assertion. Co-Authored-By: Claude Opus 4.8 <[email protected]>
104 lines
2.2 KiB
YAML
104 lines
2.2 KiB
YAML
---
|
|
# Namespace (trust zone; default-deny + policies apply)
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: baseline-demo
|
|
labels:
|
|
homelab.keithjackson.dev/app-namespace: 'true'
|
|
---
|
|
# Default-deny baseline (R-NET-01): deny all, allow only DNS
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default-deny
|
|
namespace: baseline-demo
|
|
labels:
|
|
homelab.keithjackson.dev/baseline: default-deny
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress: []
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
---
|
|
# Deployment (R-PLAT-02)
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: baseline-demo
|
|
namespace: baseline-demo
|
|
labels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
homelab.keithjackson.dev/egress-class: internet
|
|
homelab.keithjackson.dev/auth-mode: none
|
|
spec:
|
|
containers:
|
|
- name: baseline-demo
|
|
image: nginx:1.27
|
|
---
|
|
# ServiceMonitor (R-OBS-01)
|
|
apiVersion: monitoring.coreos.com/v1
|
|
kind: ServiceMonitor
|
|
metadata:
|
|
name: baseline-demo
|
|
namespace: baseline-demo
|
|
labels:
|
|
release: kube-prometheus-stack
|
|
app.kubernetes.io/name: baseline-demo
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
namespaceSelector:
|
|
matchNames:
|
|
- baseline-demo
|
|
endpoints:
|
|
- port: metrics
|
|
interval: 30s
|
|
---
|
|
# Flux ImageRepository (R-UPD)
|
|
apiVersion: image.toolkit.fluxcd.io/v1beta2
|
|
kind: ImageRepository
|
|
metadata:
|
|
name: baseline-demo
|
|
namespace: baseline-demo
|
|
spec:
|
|
image: nginx
|
|
interval: 1h0m0s
|
|
---
|
|
# Flux ImagePolicy (R-UPD)
|
|
apiVersion: image.toolkit.fluxcd.io/v1beta2
|
|
kind: ImagePolicy
|
|
metadata:
|
|
name: baseline-demo
|
|
namespace: baseline-demo
|
|
annotations:
|
|
homelab.keithjackson.dev/update-channel: stable
|
|
homelab.keithjackson.dev/auto-rollback: 'true'
|
|
spec:
|
|
imageRepositoryRef:
|
|
name: baseline-demo
|
|
policy:
|
|
semver:
|
|
range: '>=0.0.0'
|