Harden Kubernetes lab CA profile [skip ci]

tests/test_kubernetes_lab.py

@@ -1,9 +1,11 @@
 from __future__ import annotations
 
 from contextlib import redirect_stdout
+from dataclasses import replace
 import io
 import json
 from pathlib import Path
+import shutil
 import stat
 import subprocess
 import sys
@@ -24,6 +26,7 @@ from govoplan_lab.lifecycle import (  # noqa: E402
     LabOperationError,
     _assert_domain_owned,
     _domain_description,
+    _ensure_certificates,
     _render_kubectl_wrapper,
     destroy,
 )
@@ -234,6 +237,37 @@ class KubernetesLabTests(unittest.TestCase):
 
             self.assertEqual(0o600, stat.S_IMODE(path.stat().st_mode))
 
+    @unittest.skipUnless(shutil.which("openssl"), "openssl is required")
+    def test_generated_lab_ca_passes_strict_chain_validation(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="govoplan-lab-pki-") as directory:
+            config = replace(
+                load_config(REHEARSAL_CONFIG),
+                state_directory=Path(directory),
+            )
+            _ensure_certificates(config, CommandRunner(config))
+            ca_certificate = config.state_directory / "pki" / "ca.crt"
+            server_certificate = config.state_directory / "pki" / "server.crt"
+
+            result = subprocess.run(
+                [
+                    "openssl",
+                    "verify",
+                    "-x509_strict",
+                    "-CAfile",
+                    str(ca_certificate),
+                    str(server_certificate),
+                ],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                check=False,
+            )
+
+            self.assertEqual(
+                0,
+                result.returncode,
+                (result.stdout + result.stderr).decode(errors="replace"),
+            )
+
 
 if __name__ == "__main__":
     unittest.main()