Omar SobhandClaude Fable 5
e65bcd4130
- scripts/netpol-cluster.sh: a kind cluster with Calico (default CNI disabled) — the only way to PROVE the §15 default-deny NetworkPolicy, since kindnet accepts the object but never enforces it. New live test on that cluster: outbound connect to 1.1.1.1 dropped, DNS egress dropped, while API-server exec keeps working (not pod network). Kernel-level enforcement of the sandbox egress claim, demonstrated - K8sDriver::connect_with_context: pin a kubeconfig context instead of ambient. The whole k8s suite now pins its cluster explicitly — the netpol cluster's creation had silently switched the current context and stranded the seccomp test on the wrong cluster (fixed and made impossible to recur) - CI: netpol-cluster up + calico egress test in the sandbox-k8s job - Visual-regression lock (plan P6): @visual Playwright spec with animation-disabled, masked-dynamic-region screenshots of login, workspace home, chat welcome, computer panel, credits; darwin baselines committed (5 PNGs); CI excludes @visual until linux baselines are generated there. Full local suite: 33 journeys 165 Rust tests + 5 live kind tests (2 clusters) + 33 journeys. Co-Authored-By: Claude Fable 5 <[email protected]>
42 lines
1.3 KiB
Bash
Executable File
42 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# A kind cluster with a NetworkPolicy-ENFORCING CNI (Calico) for the
|
|
# egress-denial e2e: kind's default kindnet accepts NetworkPolicy objects
|
|
# but never enforces them, so only this cluster can prove the §15
|
|
# default-deny actually drops packets in the kernel.
|
|
#
|
|
# Usage: scripts/netpol-cluster.sh {up|down}
|
|
set -euo pipefail
|
|
|
|
CLUSTER="clawmates-netpol-test"
|
|
CALICO_VERSION="v3.29.1"
|
|
|
|
case "${1:-up}" in
|
|
up)
|
|
if kind get clusters 2>/dev/null | grep -qx "$CLUSTER"; then
|
|
echo "$CLUSTER already exists"
|
|
else
|
|
kind create cluster --name "$CLUSTER" --wait 120s --config - <<'EOF'
|
|
kind: Cluster
|
|
apiVersion: kind.x-k8s.io/v1alpha4
|
|
networking:
|
|
disableDefaultCNI: true
|
|
podSubnet: 192.168.0.0/16
|
|
EOF
|
|
kubectl --context "kind-$CLUSTER" apply -f \
|
|
"https://raw.githubusercontent.com/projectcalico/calico/$CALICO_VERSION/manifests/calico.yaml"
|
|
fi
|
|
echo "waiting for calico + node readiness..."
|
|
kubectl --context "kind-$CLUSTER" -n kube-system rollout status \
|
|
daemonset/calico-node --timeout=300s
|
|
kubectl --context "kind-$CLUSTER" wait --for=condition=Ready node --all --timeout=120s
|
|
echo "$CLUSTER ready (calico enforcing)"
|
|
;;
|
|
down)
|
|
kind delete cluster --name "$CLUSTER"
|
|
;;
|
|
*)
|
|
echo "usage: $0 {up|down}" >&2
|
|
exit 1
|
|
;;
|
|
esac
|