jakman85andClaude Opus 4.8
9d8e03892f
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
75 lines
3.4 KiB
YAML
75 lines
3.4 KiB
YAML
# =============================================================================
|
|
# In-cluster Chainsaw conformance Job — SKELETON (ADR-0011; docs/14)
|
|
#
|
|
# CI (Gitea Actions, T-6.1b) TRIGGERS this Job and waits for it; CI holds NO
|
|
# cluster credentials. The Job runs L1/L2/L3 under the scoped `conformance-runner`
|
|
# ServiceAccount (rbac.yaml), writes JUnit + coverage to a results location that
|
|
# CI collects, and enforces the merge / phase-exit gate on the outcome.
|
|
#
|
|
# Two invocation shapes (CI sets args):
|
|
# * MERGE GATE: ./run.sh --requirements <touched R-IDs> (subset)
|
|
# * PHASE EXIT: ./run.sh --layer all (full suite)
|
|
#
|
|
# Results artifact mechanism (delegated to WS-TEST by docs/14 open items):
|
|
# Chosen = a shared results emptyDir + a terminating log stream, with an
|
|
# OPTIONAL results PVC for durability across CI collection. For Phase 0 there is
|
|
# no cluster; this manifest is reconciled by Flux from Phase 1+ and exercised
|
|
# once L2/L3 can run. CI collects `report.junit.xml` + `coverage/` from the
|
|
# results volume (or scrapes the pod log, which echoes their paths).
|
|
#
|
|
# NOT applied in Phase 0 (no cluster). Image tag pinned to versions.env CHAINSAW_IMAGE.
|
|
# =============================================================================
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
generateName: conformance-run-
|
|
namespace: conformance
|
|
labels:
|
|
app.kubernetes.io/part-of: conformance
|
|
spec:
|
|
backoffLimit: 0 # deterministic: a failed conformance run is a failure, no retry
|
|
ttlSecondsAfterFinished: 3600
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/part-of: conformance
|
|
spec:
|
|
serviceAccountName: conformance-runner # scoped test identity (rbac.yaml)
|
|
restartPolicy: Never
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
seccompProfile: { type: RuntimeDefault }
|
|
containers:
|
|
- name: chainsaw
|
|
# PIN to versions.env CHAINSAW_IMAGE (ghcr.io/kyverno/chainsaw:v0.2.12).
|
|
image: ghcr.io/kyverno/chainsaw:v0.2.12
|
|
workingDir: /workspace/conformance
|
|
# The suite repo is delivered into /workspace (git clone init-container or
|
|
# a Flux-populated volume). run.sh is the single entrypoint (identical to local).
|
|
command: ["./run.sh"]
|
|
# CI overrides args per invocation shape:
|
|
# ["--requirements", "R-NET-01,R-NET-06"] (merge gate) OR
|
|
# ["--layer", "all", "--strict-coverage"] (phase exit)
|
|
args: ["--layer", "all", "--strict-coverage"]
|
|
env:
|
|
- name: CONF_ROOT
|
|
value: /workspace/conformance
|
|
volumeMounts:
|
|
- { name: workspace, mountPath: /workspace }
|
|
- { name: results, mountPath: /workspace/conformance/_artifacts }
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities: { drop: ["ALL"] }
|
|
runAsNonRoot: true
|
|
volumes:
|
|
# Suite source: populated by an init-container git clone of the impl repo at
|
|
# the commit under test, OR a Flux-synced source volume. (Init container
|
|
# omitted from this skeleton; wire in T-6.1b.)
|
|
- name: workspace
|
|
emptyDir: {}
|
|
# Results: CI collects report.junit.xml + coverage/ from here. Swap emptyDir
|
|
# for a results PVC if durability beyond pod lifetime is required.
|
|
- name: results
|
|
emptyDir: {}
|