p2p

tests/render.yml

@@ -13,7 +13,9 @@
         wikideck_image: "{{ render_case.image | default('registry.example.com/wikideck:1.0.0') }}"
         wikideck_name: "{{ render_case.name | default('wikideck') }}"
         wikideck_namespace: "{{ render_case.namespace | default('wikideck') }}"
-        wikideck_offline: "{{ render_case.offline | default(false) }}"
+        wikideck_peers: "{{ render_case.peers | default([]) }}"
+        wikideck_allow_private_peers: "{{ render_case.allow_private | default(false) }}"
+        wikideck_startup_probe_failure_threshold: "{{ render_case.startup_threshold | default(180) }}"
         wikideck_ingress_enabled: "{{ render_case.ingress | default(false) }}"
         wikideck_ingress_host: wikideck.example.com
         wikideck_public_origin: "{{ 'https://wikideck.example.com' if render_case.ingress | default(false) else '' }}"
@@ -25,9 +27,12 @@
         wikideck_network_policy_ingress_from: "{{ render_case.ingress_from | default([{'podSelector': {}}]) }}"
         wikideck_network_policy_dns_to: "{{ render_case.dns_to | default([{'namespaceSelector': {}}]) }}"
         wikideck_network_policy_https_to: "{{ render_case.https_to | default([{'ipBlock': {'cidr': '0.0.0.0/0'}}]) }}"
+        wikideck_network_policy_https_ports: "{{ render_case.https_ports | default([443]) }}"
+        wikideck_network_policy_peer_egress: "{{ render_case.peer_egress | default([]) }}"
       loop:
-        - label: defaults
+        - label: isolated validator defaults
         - label: TLS ingress and existing storage
+          peers: [https://peer-a.example.org, https://peer-b.example.org]
           ingress: true
           ingress_class: nginx
           annotations:
@@ -37,15 +42,35 @@
           pull_secrets: [registry-credentials]
           name: custom-deck
           namespace: games
-        - label: offline and no storage class
-          offline: true
+        - label: isolated validator and no storage class
           storage_class: ""
         - label: default-deny all traffic
           ingress_from: []
           dns_to: []
           https_to: []
-        - label: DNS-only offline mode
-          offline: true
+        - label: public peers with custom HTTPS port and long startup
+          peers: [https://peer.example.org:8443]
+          https_ports: [443, 8443]
+          startup_threshold: 360
+        - label: private HTTP testnet with restricted egress
+          peers: [http://other-node.games.svc.cluster.local:80]
+          allow_private: true
+          https_to: []
+          peer_egress:
+            - to:
+                - namespaceSelector:
+                    matchLabels:
+                      kubernetes.io/metadata.name: games
+                  podSelector:
+                    matchLabels:
+                      app.kubernetes.io/instance: other-node
+              ports:
+                - protocol: TCP
+                  port: 3001
+        - label: public peer with all egress explicitly denied
+          peers: [https://peer.example.org]
+          dns_to: []
+          https_to: []
         - label: digest-pinned image
           image: registry.example.com/wikideck@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
       loop_control:
@@ -84,11 +109,43 @@
           resources:
             requests: {cpu: 100m, memory: 128Mi}
         - label: ambiguous boolean
-          offline: "false"
+          allow_private: "false"
         - label: wrong list type
           pull_secrets: not-a-list
         - label: empty peer allows all traffic
           ingress_from: [{}]
+        - label: too many peers
+          peers: [https://a.example.org, https://b.example.org, https://c.example.org, https://d.example.org, https://e.example.org, https://f.example.org, https://g.example.org, https://h.example.org, https://i.example.org, https://j.example.org, https://k.example.org, https://l.example.org, https://m.example.org, https://n.example.org, https://o.example.org, https://p.example.org, https://q.example.org]
+        - label: peers must be a list
+          peers: https://peer.example.org
+        - label: HTTP peers need explicit opt-in
+          peers: [http://peer.example.org]
+        - label: credentials in peer URL
+          peers: [https://user:password@peer.example.org]
+        - label: path in peer URL
+          peers: [https://peer.example.org/p2p]
+        - label: query in peer URL
+          peers: ['https://peer.example.org?x=1']
+        - label: comma can inject a second peer
+          peers: ['https://peer.example.org,https://another.example.org']
+        - label: zero startup threshold
+          startup_threshold: 0
+        - label: invalid HTTPS egress port
+          https_ports: [65536]
+        - label: egress rule without destinations
+          peer_egress:
+            - ports: [{protocol: TCP, port: 3001}]
+        - label: egress rule without ports
+          peer_egress:
+            - to: [{podSelector: {}}]
+        - label: egress rule with an empty peer
+          peer_egress:
+            - to: [{}]
+              ports: [{protocol: TCP, port: 3001}]
+        - label: non-TCP peer egress
+          peer_egress:
+            - to: [{podSelector: {}}]
+              ports: [{protocol: UDP, port: 3001}]
       loop_control:
         loop_var: invalid_case
         label: "{{ invalid_case.label }}"