jakman85andClaude Opus 4.8
9d8e03892f
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
47 lines
1.9 KiB
YAML
47 lines
1.9 KiB
YAML
# =============================================================================
|
|
# L2 BEHAVIORAL SCAFFOLD — VM lifecycle (R-PLAT-03)
|
|
# Catalog: docs/14 "VM lifecycle (R-PLAT-03, L2/L3)"
|
|
#
|
|
# GIVEN a `kind: vm` ServiceDefinition,
|
|
# WHEN it is created/started/stopped/destroyed via kubectl/virtctl,
|
|
# THEN it behaves through the same K8s surface; default-deny + egress class
|
|
# apply to it. (Disk-survives-rebuild is the L3 partner test, see
|
|
# tests/l3-fault-injection/data-survival — VMs share R-STATE-01.)
|
|
#
|
|
# STATUS: scaffold — needs T-5.1/T-5.2 (KubeVirt + `kind: vm` path).
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: vm-lifecycle
|
|
labels:
|
|
conformance.home.k3s/R-PLAT-03: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-PLAT-03"
|
|
conformance.home.k3s/layer: "L2"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/intent: >-
|
|
A VM is created/started/stopped/destroyed via the K8s API; policy applies.
|
|
spec:
|
|
steps:
|
|
- name: given-vm-servicedefinition
|
|
try:
|
|
- apply:
|
|
file: fixtures/vm-servicedefinition.yaml # TODO(T-5.2): author
|
|
- name: when-start-and-assert-running
|
|
try:
|
|
- script:
|
|
content: |
|
|
set -euo pipefail
|
|
# virtctl start via the same kubectl surface; assert VMI Running.
|
|
kubectl -n "$NAMESPACE" patch vm demo --type merge -p '{"spec":{"running":true}}'
|
|
echo "TODO(T-5.3): wait VMI phase=Running (bounded), then STARTED_OK"
|
|
- name: then-default-deny-and-egress-apply-to-vm
|
|
try:
|
|
- script:
|
|
content: 'echo "TODO: run default-deny + egress-class probes from inside the VM"'
|
|
- name: when-stop-and-destroy
|
|
try:
|
|
- script:
|
|
content: 'echo "TODO(T-5.3): stop then delete VM via kubectl; assert gone"'
|