jakman85andClaude Opus 5.5
50ec2297ee
Stdlib-only scanner per docs/17: Kubernetes API inventory, Trivy runner, persisted state, schema-validated report.json, strict acceptances parser, server-rendered page, aggregate metrics, internal API, and a scan loop that stays live while scanning. L1 tests under conformance/tests/l1-rendering/vuln-scanner-* run the actual modules against recorded fixtures with a fake Trivy runner. Co-Authored-By: Claude Opus 5.5 <[email protected]>
29 lines
1.3 KiB
YAML
29 lines
1.3 KiB
YAML
# L1 fixture test: runs check.py (python3 stdlib, source imported from platform/vuln-scanner/src,
|
|
# no cluster, no network beyond loopback). conformance/run.sh --layer l1 runs check.sh offline;
|
|
# this Chainsaw Test wraps the same script so an in-cluster run executes identical assertions.
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: vuln-scanner-api-metrics
|
|
labels:
|
|
conformance.home.k3s/R-VULN-02: "true"
|
|
conformance.home.k3s/R-VULN-03: "true"
|
|
conformance.home.k3s/R-VULN-05: "true"
|
|
conformance.home.k3s/R-VULN-06: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-VULN-02, R-VULN-03, R-VULN-05, R-VULN-06"
|
|
conformance.home.k3s/layer: "L1"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
# Whole-repo scope: the touched-path map keys nothing to platform/vuln-scanner, so without this
|
|
# a change to the scanner would select no vuln-scanner test.
|
|
conformance.home.k3s/scope: "whole-repo"
|
|
conformance.home.k3s/intent: >-
|
|
Given a running engine, When the HTTP surfaces are exercised, Then the API validates, metrics are aggregates only, and listeners answer during a scan.
|
|
spec:
|
|
steps:
|
|
- name: run-offline-check
|
|
description: Run check.sh, the same assertions the offline harness runs.
|
|
try:
|
|
- script:
|
|
content: bash ./check.sh
|