jakman85
5ba3f9d46d
Rewrote the probe for the LE-production switch: no embedded staging root, no --cacert (system CA bundle validates ISRG Root X1), resolves the hostname via in-cluster split-horizon DNS to the Gateway VIP (the real-client path). PASSES live (9s). Removed the le-staging-root-ca fixture.
83 lines
4.2 KiB
YAML
83 lines
4.2 KiB
YAML
# =============================================================================
|
|
# L2 BEHAVIORAL — Trusted TLS (R-TLS-01, R-TLS-03) [RUNNABLE]
|
|
# Catalog: docs/14 "Trusted TLS (R-TLS-01/02)"
|
|
# Spec: docs/09 (Gateway API + DNS-01 wildcard), ADR-0006 (LE issuers)
|
|
#
|
|
# GIVEN the shared Gateway terminating TLS with the cert-manager wildcard cert,
|
|
# WHEN an in-cluster probe dials it by hostname (SNI *.home.keithjackson.dev) and
|
|
# verifies the chain against the SYSTEM trust store,
|
|
# THEN the served cert is non-self-signed, unexpired, covers the wildcard SAN, and
|
|
# chains to a PUBLICLY-TRUSTED CA root (R-TLS-01). The wildcard SAN also covers
|
|
# internal-only hostnames, so internal services get the same trusted cert (R-TLS-03).
|
|
#
|
|
# TRUST MODEL: the cluster issues from Let's Encrypt **PRODUCTION** (ACME_CLUSTER_ISSUER
|
|
# = letsencrypt-prod), whose root (ISRG Root X1) is in the system trust store — so the
|
|
# probe verifies against the container's DEFAULT CA bundle (no --cacert). A clean verify
|
|
# is exactly what real in-cluster OIDC clients (oauth2-proxy, Grafana) depend on. The
|
|
# probe resolves the hostname via in-cluster split-horizon DNS (coredns-custom → Gateway
|
|
# VIP, R-DNS-01) — the same path real clients use — so no --connect-to hack is needed.
|
|
# Replaced the earlier LE-staging + embedded-root check when dev switched to LE-prod so
|
|
# in-cluster SSO clients trust the cert (DECISIONS-LOG Session 7).
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: trusted-tls
|
|
labels:
|
|
conformance.home.k3s/R-TLS-01: "true"
|
|
conformance.home.k3s/R-TLS-03: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-TLS-01, R-TLS-03"
|
|
conformance.home.k3s/layer: "L2"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/executable: "true"
|
|
conformance.home.k3s/intent: >-
|
|
The shared Gateway serves a valid, unexpired, non-self-signed wildcard cert
|
|
that chains to a publicly-trusted CA root (LE production); the wildcard SAN
|
|
covers internal-only hostnames too.
|
|
spec:
|
|
steps:
|
|
- name: then-gateway-cert-chains-to-trusted-root
|
|
try:
|
|
- apply:
|
|
resource:
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: tls-probe
|
|
spec:
|
|
backoffLimit: 4
|
|
activeDeadlineSeconds: 180
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: probe
|
|
image: curlimages/curl:8.11.1
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -eu
|
|
# Probe TWO wildcard hostnames — one "public", one "internal-only". Both
|
|
# match *.home.keithjackson.dev, so a clean verify against the SYSTEM CA
|
|
# bundle for BOTH proves R-TLS-01 (chains to a publicly-trusted root) AND
|
|
# R-TLS-03 (the same trusted wildcard covers internal-only names). Names
|
|
# resolve via in-cluster split-horizon DNS to the Gateway VIP. curl (no
|
|
# --cacert, no -k) validates against the default CA bundle and exits 0 on
|
|
# the gateway's 404 once TLS+hostname verify; it exits 60 if the chain or
|
|
# hostname fails. TLS terminates at the gateway before HTTP routing, so no
|
|
# backend is needed.
|
|
for host in conformance.home.keithjackson.dev internal-only.home.keithjackson.dev; do
|
|
curl -sS --retry 5 --retry-connrefused --retry-delay 3 --max-time 20 \
|
|
-o /dev/null "https://${host}/"
|
|
echo "TLS_TRUSTED ${host}"
|
|
done
|
|
echo ALL_TRUSTED
|
|
- assert:
|
|
resource:
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata: { name: tls-probe }
|
|
status: { succeeded: 1 }
|