test

Run policy assertions against the plan Kyku would generate from your config and local state. kyku test never calls the cloud.

See ADR-001 for why this is a typed TypeScript API rather than Gherkin.

Usage

kyku test [options]

Policy file

Default path: ./infrastructure.test.ts. Default-export a Policy or Policy[]:

import { definePolicy, findOpenIngress } from '@kykucloud/core'

export default [
  definePolicy('ssh-not-world-open', ({ resources, fail }) => {
    for (const resource of resources) {
      for (const hit of findOpenIngress(resource, { port: 22 })) {
        fail(`${resource.id}: SSH open to ${hit.source}`, resource.id)
      }
    }
  }),
]

ctx.plan is the offline plan (creates/updates/destroys from local state, no readState). ctx.resources is the desired graph after auto-subnet injection.

There is no OPA/Rego, no watch mode, and no coverage report.

Options

Flag	Default	Description
-c, --config <path>	./infrastructure.ts	Config file
-t, --test <path>	./infrastructure.test.ts	Policy file
-e, --env <environment>	default	Environment workspace
--state-dir <dir>	.kyku	State directory (read-only)

Exit Codes

Code	Meaning
0	Every policy passed
1	A policy called fail(), or the policy/config file could not be loaded

Examples

The repo sample in examples/policy/:

# open SSH (0.0.0.0/0) fails
kyku test -c examples/policy/open-ssh.ts -t examples/policy/ssh.test.ts

# narrowed source passes
kyku test -c examples/policy/narrow-ssh.ts -t examples/policy/ssh.test.ts