2024-02-02 10:04:02 +00:00
|
|
|
package validatingadmissionpolicy
|
2023-08-31 10:25:21 +00:00
|
|
|
|
|
|
|
import (
|
|
|
|
"encoding/json"
|
|
|
|
"testing"
|
|
|
|
|
2024-08-13 11:55:22 +00:00
|
|
|
"github.com/kyverno/kyverno/api/kyverno"
|
2023-08-31 10:25:21 +00:00
|
|
|
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
|
2024-08-13 11:55:22 +00:00
|
|
|
kyvernov2 "github.com/kyverno/kyverno/api/kyverno/v2"
|
|
|
|
kyvernov2beta1 "github.com/kyverno/kyverno/api/kyverno/v2beta1"
|
2023-08-31 10:25:21 +00:00
|
|
|
yamlutils "github.com/kyverno/kyverno/pkg/utils/yaml"
|
|
|
|
"gotest.tools/assert"
|
2024-08-13 11:55:22 +00:00
|
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
2023-08-31 10:25:21 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
func Test_Check_Resources(t *testing.T) {
|
|
|
|
testCases := []struct {
|
|
|
|
name string
|
|
|
|
resource []byte
|
|
|
|
expected bool
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "resource-with-namespaces",
|
|
|
|
resource: []byte(`
|
|
|
|
{
|
|
|
|
"kinds": [
|
|
|
|
"Service"
|
|
|
|
],
|
|
|
|
"namespaces": [
|
|
|
|
"prod"
|
|
|
|
],
|
|
|
|
"operations": [
|
|
|
|
"CREATE"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
`),
|
2024-05-08 11:09:47 +00:00
|
|
|
expected: true,
|
2023-08-31 10:25:21 +00:00
|
|
|
},
|
2024-05-10 14:19:10 +00:00
|
|
|
{
|
|
|
|
name: "namespaces-with-wildcards",
|
|
|
|
resource: []byte(`
|
|
|
|
{
|
|
|
|
"kinds": [
|
|
|
|
"Service"
|
|
|
|
],
|
|
|
|
"namespaces": [
|
|
|
|
"prod-*"
|
|
|
|
],
|
|
|
|
"operations": [
|
|
|
|
"CREATE"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
`),
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "resource-names-with-wildcards",
|
|
|
|
resource: []byte(`
|
|
|
|
{
|
|
|
|
"kinds": [
|
|
|
|
"Service"
|
|
|
|
],
|
|
|
|
"names": [
|
|
|
|
"svc-*"
|
|
|
|
],
|
|
|
|
"operations": [
|
|
|
|
"CREATE"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
`),
|
|
|
|
expected: false,
|
|
|
|
},
|
2023-08-31 10:25:21 +00:00
|
|
|
{
|
|
|
|
name: "resource-with-annotations",
|
|
|
|
resource: []byte(`
|
|
|
|
{
|
|
|
|
"annotations": {
|
|
|
|
"imageregistry": "https://hub.docker.com/"
|
|
|
|
},
|
|
|
|
"kinds": [
|
|
|
|
"Pod"
|
|
|
|
],
|
|
|
|
"operations": [
|
|
|
|
"CREATE",
|
|
|
|
"UPDATE"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
`),
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "resource-with-object-selector",
|
|
|
|
resource: []byte(`
|
|
|
|
{
|
|
|
|
"kinds": [
|
|
|
|
"Pod"
|
|
|
|
],
|
|
|
|
"operations": [
|
|
|
|
"CREATE",
|
|
|
|
"UPDATE"
|
|
|
|
],
|
|
|
|
"selector": {
|
|
|
|
"matchLabels": {
|
|
|
|
"app": "critical"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`),
|
|
|
|
expected: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "resource-with-namespace-selector",
|
|
|
|
resource: []byte(`
|
|
|
|
{
|
|
|
|
"kinds": [
|
|
|
|
"Pod"
|
|
|
|
],
|
|
|
|
"operations": [
|
|
|
|
"CREATE",
|
|
|
|
"UPDATE"
|
|
|
|
],
|
|
|
|
"namespaceSelector": {
|
|
|
|
"matchLabels": {
|
|
|
|
"app": "critical"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`),
|
|
|
|
expected: true,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, test := range testCases {
|
|
|
|
t.Run(test.name, func(t *testing.T) {
|
|
|
|
var res kyvernov1.ResourceDescription
|
|
|
|
err := json.Unmarshal(test.resource, &res)
|
|
|
|
assert.NilError(t, err)
|
2024-07-16 15:06:58 +00:00
|
|
|
out, _ := checkResources(res, true)
|
2023-08-31 10:25:21 +00:00
|
|
|
assert.Equal(t, out, test.expected)
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-08-13 11:55:22 +00:00
|
|
|
func Test_Check_Exception(t *testing.T) {
|
|
|
|
testCases := []struct {
|
|
|
|
name string
|
|
|
|
exceptions []kyvernov2.PolicyException
|
|
|
|
expected bool
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "exception-with-multiple-policies",
|
|
|
|
exceptions: []kyvernov2.PolicyException{
|
|
|
|
{
|
|
|
|
Spec: kyvernov2.PolicyExceptionSpec{
|
|
|
|
Exceptions: []kyvernov2.Exception{
|
|
|
|
{
|
|
|
|
PolicyName: "test-1",
|
|
|
|
RuleNames: []string{"rule-1"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
PolicyName: "test-2",
|
|
|
|
RuleNames: []string{"rule-2"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
expected: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "exception-with-multiple-rules",
|
|
|
|
exceptions: []kyvernov2.PolicyException{
|
|
|
|
{
|
|
|
|
Spec: kyvernov2.PolicyExceptionSpec{
|
|
|
|
Exceptions: []kyvernov2.Exception{
|
|
|
|
{
|
|
|
|
PolicyName: "test-1",
|
|
|
|
RuleNames: []string{"rule-1", "rule-2"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "exception-with-multiple-rules-in-different-exceptions",
|
|
|
|
exceptions: []kyvernov2.PolicyException{
|
|
|
|
{
|
|
|
|
Spec: kyvernov2.PolicyExceptionSpec{
|
|
|
|
Exceptions: []kyvernov2.Exception{
|
|
|
|
{
|
|
|
|
PolicyName: "test-1",
|
|
|
|
RuleNames: []string{"rule-1", "rule-2"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
PolicyName: "test-2",
|
|
|
|
RuleNames: []string{"rule-1"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "exception-with-conditions",
|
|
|
|
exceptions: []kyvernov2.PolicyException{
|
|
|
|
{
|
|
|
|
Spec: kyvernov2.PolicyExceptionSpec{
|
|
|
|
Exceptions: []kyvernov2.Exception{
|
|
|
|
{
|
|
|
|
PolicyName: "test-1",
|
|
|
|
RuleNames: []string{"rule-1"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Conditions: &kyvernov2.AnyAllConditions{
|
|
|
|
AllConditions: []kyvernov2.Condition{
|
|
|
|
{
|
|
|
|
RawKey: &kyverno.Any{
|
|
|
|
Value: "{{ request.object.name }}",
|
|
|
|
},
|
|
|
|
Operator: kyvernov2.ConditionOperators["Equals"],
|
|
|
|
RawValue: &kyverno.Any{
|
|
|
|
Value: "dummy",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "exception-with-multiple-all",
|
|
|
|
exceptions: []kyvernov2.PolicyException{
|
|
|
|
{
|
|
|
|
Spec: kyvernov2.PolicyExceptionSpec{
|
|
|
|
Exceptions: []kyvernov2.Exception{
|
|
|
|
{
|
|
|
|
PolicyName: "test-1",
|
|
|
|
RuleNames: []string{"rule-1"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Match: kyvernov2beta1.MatchResources{
|
|
|
|
All: kyvernov1.ResourceFilters{
|
|
|
|
kyvernov1.ResourceFilter{
|
|
|
|
ResourceDescription: kyvernov1.ResourceDescription{
|
|
|
|
Kinds: []string{"Pod"},
|
|
|
|
Operations: []kyvernov1.AdmissionOperation{"CREATE"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
kyvernov1.ResourceFilter{
|
|
|
|
ResourceDescription: kyvernov1.ResourceDescription{
|
|
|
|
Kinds: []string{"Pod"},
|
|
|
|
Operations: []kyvernov1.AdmissionOperation{"CREATE"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "exception-with-namespace-selector",
|
|
|
|
exceptions: []kyvernov2.PolicyException{
|
|
|
|
{
|
|
|
|
Spec: kyvernov2.PolicyExceptionSpec{
|
|
|
|
Exceptions: []kyvernov2.Exception{
|
|
|
|
{
|
|
|
|
PolicyName: "test-1",
|
|
|
|
RuleNames: []string{"rule-1"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Match: kyvernov2beta1.MatchResources{
|
|
|
|
Any: kyvernov1.ResourceFilters{
|
|
|
|
kyvernov1.ResourceFilter{
|
|
|
|
ResourceDescription: kyvernov1.ResourceDescription{
|
|
|
|
Kinds: []string{"Pod"},
|
|
|
|
Operations: []kyvernov1.AdmissionOperation{"CREATE"},
|
|
|
|
NamespaceSelector: &metav1.LabelSelector{
|
|
|
|
MatchLabels: map[string]string{
|
|
|
|
"app": "critical",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "exception-with-object-selector",
|
|
|
|
exceptions: []kyvernov2.PolicyException{
|
|
|
|
{
|
|
|
|
Spec: kyvernov2.PolicyExceptionSpec{
|
|
|
|
Exceptions: []kyvernov2.Exception{
|
|
|
|
{
|
|
|
|
PolicyName: "test-1",
|
|
|
|
RuleNames: []string{"rule-1"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Match: kyvernov2beta1.MatchResources{
|
|
|
|
Any: kyvernov1.ResourceFilters{
|
|
|
|
kyvernov1.ResourceFilter{
|
|
|
|
ResourceDescription: kyvernov1.ResourceDescription{
|
|
|
|
Kinds: []string{"Pod"},
|
|
|
|
Operations: []kyvernov1.AdmissionOperation{"CREATE"},
|
|
|
|
Selector: &metav1.LabelSelector{
|
|
|
|
MatchLabels: map[string]string{
|
|
|
|
"app": "critical",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "exception-with-multiple-any",
|
|
|
|
exceptions: []kyvernov2.PolicyException{
|
|
|
|
{
|
|
|
|
Spec: kyvernov2.PolicyExceptionSpec{
|
|
|
|
Exceptions: []kyvernov2.Exception{
|
|
|
|
{
|
|
|
|
PolicyName: "test-1",
|
|
|
|
RuleNames: []string{"rule-1"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Match: kyvernov2beta1.MatchResources{
|
|
|
|
Any: kyvernov1.ResourceFilters{
|
|
|
|
kyvernov1.ResourceFilter{
|
|
|
|
ResourceDescription: kyvernov1.ResourceDescription{
|
|
|
|
Kinds: []string{"Pod"},
|
|
|
|
Operations: []kyvernov1.AdmissionOperation{"CREATE"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
kyvernov1.ResourceFilter{
|
|
|
|
ResourceDescription: kyvernov1.ResourceDescription{
|
|
|
|
Kinds: []string{"Pod"},
|
|
|
|
Operations: []kyvernov1.AdmissionOperation{"CREATE"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
expected: true,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
for _, test := range testCases {
|
|
|
|
t.Run(test.name, func(t *testing.T) {
|
|
|
|
out, _ := checkExceptions(test.exceptions)
|
|
|
|
assert.Equal(t, out, test.expected)
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-08-31 10:25:21 +00:00
|
|
|
func Test_Can_Generate_ValidatingAdmissionPolicy(t *testing.T) {
|
|
|
|
testCases := []struct {
|
|
|
|
name string
|
|
|
|
policy []byte
|
|
|
|
expected bool
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "policy-with-two-rules",
|
|
|
|
policy: []byte(`
|
|
|
|
{
|
|
|
|
"apiVersion": "kyverno.io/v1",
|
|
|
|
"kind": "ClusterPolicy",
|
|
|
|
"metadata": {
|
|
|
|
"name": "disallow-latest-tag"
|
|
|
|
},
|
|
|
|
"spec": {
|
|
|
|
"rules": [
|
|
|
|
{
|
|
|
|
"name": "require-image-tag",
|
|
|
|
"match": {
|
|
|
|
"any": [
|
|
|
|
{
|
|
|
|
"resources": {
|
|
|
|
"kinds": [
|
|
|
|
"Pod"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
},
|
|
|
|
"validate": {
|
|
|
|
"cel": {
|
|
|
|
"expressions": [
|
|
|
|
{
|
|
|
|
"expression": "object.spec.containers.all(container, !container.image.matches('^[a-zA-Z]+:[0-9]*$'))"
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"name": "validate-image-tag",
|
|
|
|
"match": {
|
|
|
|
"any": [
|
|
|
|
{
|
|
|
|
"resources": {
|
|
|
|
"kinds": [
|
|
|
|
"Pod"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
},
|
|
|
|
"validate": {
|
|
|
|
"cel": {
|
|
|
|
"expressions": [
|
|
|
|
{
|
|
|
|
"expression": "object.spec.containers.all(container, !container.image.contains('latest'))"
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`),
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "policy-with-mutate-rule",
|
|
|
|
policy: []byte(`
|
|
|
|
{
|
|
|
|
"apiVersion": "kyverno.io/v1",
|
|
|
|
"kind": "ClusterPolicy",
|
|
|
|
"metadata": {
|
|
|
|
"name": "set-image-pull-policy"
|
|
|
|
},
|
|
|
|
"spec": {
|
|
|
|
"rules": [
|
|
|
|
{
|
|
|
|
"name": "set-image-pull-policy",
|
|
|
|
"match": {
|
|
|
|
"any": [
|
|
|
|
{
|
|
|
|
"resources": {
|
|
|
|
"kinds": [
|
|
|
|
"Pod"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
},
|
|
|
|
"mutate": {
|
|
|
|
"patchStrategicMerge": {
|
|
|
|
"spec": {
|
|
|
|
"containers": [
|
|
|
|
{
|
|
|
|
"(image)": "*:latest",
|
|
|
|
"imagePullPolicy": "IfNotPresent"
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`),
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "policy-with-non-CEL-validate-rule",
|
|
|
|
policy: []byte(`
|
|
|
|
{
|
|
|
|
"apiVersion": "kyverno.io/v1",
|
|
|
|
"kind": "ClusterPolicy",
|
|
|
|
"metadata": {
|
|
|
|
"name": "require-ns-purpose-label"
|
|
|
|
},
|
|
|
|
"spec": {
|
|
|
|
"validationFailureAction": "Enforce",
|
|
|
|
"rules": [
|
|
|
|
{
|
|
|
|
"name": "require-ns-purpose-label",
|
|
|
|
"match": {
|
|
|
|
"any": [
|
|
|
|
{
|
|
|
|
"resources": {
|
|
|
|
"kinds": [
|
|
|
|
"Namespace"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
},
|
|
|
|
"validate": {
|
|
|
|
"pattern": {
|
|
|
|
"metadata": {
|
|
|
|
"labels": {
|
|
|
|
"purpose": "production"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`),
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "policy-with-multiple-validationFailureActionOverrides",
|
|
|
|
policy: []byte(`
|
|
|
|
{
|
|
|
|
"apiVersion": "kyverno.io/v1",
|
|
|
|
"kind": "ClusterPolicy",
|
|
|
|
"metadata": {
|
|
|
|
"name": "disallow-host-path"
|
|
|
|
},
|
|
|
|
"spec": {
|
|
|
|
"validationFailureAction": "Enforce",
|
|
|
|
"validationFailureActionOverrides": [
|
|
|
|
{
|
|
|
|
"action": "Enforce",
|
|
|
|
"namespaces": [
|
|
|
|
"default"
|
|
|
|
]
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"action": "Audit",
|
|
|
|
"namespaces": [
|
|
|
|
"test"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
],
|
|
|
|
"rules": [
|
|
|
|
{
|
|
|
|
"name": "host-path",
|
|
|
|
"match": {
|
|
|
|
"any": [
|
|
|
|
{
|
|
|
|
"resources": {
|
|
|
|
"kinds": [
|
|
|
|
"Pod"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
},
|
|
|
|
"validate": {
|
|
|
|
"cel": {
|
|
|
|
"expressions": [
|
|
|
|
{
|
|
|
|
"expression": "!has(object.spec.volumes) || object.spec.volumes.all(volume, !has(volume.hostPath))"
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`),
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "policy-with-namespace-in-validationFailureActionOverrides",
|
|
|
|
policy: []byte(`
|
|
|
|
{
|
|
|
|
"apiVersion": "kyverno.io/v1",
|
|
|
|
"kind": "ClusterPolicy",
|
|
|
|
"metadata": {
|
|
|
|
"name": "disallow-host-path"
|
|
|
|
},
|
|
|
|
"spec": {
|
|
|
|
"validationFailureAction": "Enforce",
|
|
|
|
"validationFailureActionOverrides": [
|
|
|
|
{
|
|
|
|
"action": "Enforce",
|
|
|
|
"namespaces": [
|
|
|
|
"test-ns"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
],
|
|
|
|
"rules": [
|
|
|
|
{
|
|
|
|
"name": "host-path",
|
|
|
|
"match": {
|
|
|
|
"any": [
|
|
|
|
{
|
|
|
|
"resources": {
|
|
|
|
"kinds": [
|
|
|
|
"Pod"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
},
|
|
|
|
"validate": {
|
|
|
|
"cel": {
|
|
|
|
"expressions": [
|
|
|
|
{
|
|
|
|
"expression": "!has(object.spec.volumes) || object.spec.volumes.all(volume, !has(volume.hostPath))"
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
2024-06-26 07:13:02 +00:00
|
|
|
`),
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "policy-with-multiple-validationFailureActionOverrides-in-validate-rule",
|
|
|
|
policy: []byte(`
|
|
|
|
{
|
|
|
|
"apiVersion": "kyverno.io/v1",
|
|
|
|
"kind": "ClusterPolicy",
|
|
|
|
"metadata": {
|
|
|
|
"name": "disallow-host-path"
|
|
|
|
},
|
|
|
|
"spec": {
|
|
|
|
"rules": [
|
|
|
|
{
|
|
|
|
"name": "host-path",
|
|
|
|
"match": {
|
|
|
|
"any": [
|
|
|
|
{
|
|
|
|
"resources": {
|
|
|
|
"kinds": [
|
|
|
|
"Pod"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
},
|
|
|
|
"validate": {
|
2024-08-27 20:07:57 +00:00
|
|
|
"failureAction": "Enforce",
|
|
|
|
"failureActionOverrides": [
|
2024-06-26 07:13:02 +00:00
|
|
|
{
|
|
|
|
"action": "Enforce",
|
|
|
|
"namespaces": [
|
|
|
|
"default"
|
|
|
|
]
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"action": "Audit",
|
|
|
|
"namespaces": [
|
|
|
|
"test"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
],
|
|
|
|
"cel": {
|
|
|
|
"expressions": [
|
|
|
|
{
|
|
|
|
"expression": "!has(object.spec.volumes) || object.spec.volumes.all(volume, !has(volume.hostPath))"
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`),
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "policy-with-namespace-in-validationFailureActionOverrides-in-validate-rule",
|
|
|
|
policy: []byte(`
|
|
|
|
{
|
|
|
|
"apiVersion": "kyverno.io/v1",
|
|
|
|
"kind": "ClusterPolicy",
|
|
|
|
"metadata": {
|
|
|
|
"name": "disallow-host-path"
|
|
|
|
},
|
|
|
|
"spec": {
|
|
|
|
"rules": [
|
|
|
|
{
|
|
|
|
"name": "host-path",
|
|
|
|
"match": {
|
|
|
|
"any": [
|
|
|
|
{
|
|
|
|
"resources": {
|
|
|
|
"kinds": [
|
|
|
|
"Pod"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
},
|
|
|
|
"validate": {
|
2024-08-27 20:07:57 +00:00
|
|
|
"failureAction": "Enforce",
|
|
|
|
"failureActionOverrides": [
|
2024-06-26 07:13:02 +00:00
|
|
|
{
|
|
|
|
"action": "Enforce",
|
|
|
|
"namespaces": [
|
|
|
|
"test-ns"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
],
|
|
|
|
"cel": {
|
|
|
|
"expressions": [
|
|
|
|
{
|
|
|
|
"expression": "!has(object.spec.volumes) || object.spec.volumes.all(volume, !has(volume.hostPath))"
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
2023-08-31 10:25:21 +00:00
|
|
|
`),
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "policy-with-subjects-and-clusterroles",
|
|
|
|
policy: []byte(`
|
|
|
|
{
|
|
|
|
"apiVersion": "kyverno.io/v1",
|
|
|
|
"kind": "ClusterPolicy",
|
|
|
|
"metadata": {
|
|
|
|
"name": "disallow-host-path"
|
|
|
|
},
|
|
|
|
"spec": {
|
|
|
|
"validationFailureAction": "Enforce",
|
|
|
|
"rules": [
|
|
|
|
{
|
|
|
|
"name": "host-path",
|
|
|
|
"match": {
|
|
|
|
"any": [
|
|
|
|
{
|
|
|
|
"resources": {
|
|
|
|
"kinds": [
|
|
|
|
"Deployment"
|
|
|
|
],
|
|
|
|
"operations": [
|
|
|
|
"CREATE",
|
|
|
|
"UPDATE"
|
|
|
|
]
|
|
|
|
},
|
|
|
|
"subjects": [
|
|
|
|
{
|
|
|
|
"kind": "User",
|
|
|
|
"name": "mary@somecorp.com"
|
|
|
|
}
|
|
|
|
],
|
|
|
|
"clusterRoles": [
|
|
|
|
"cluster-admin"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
]
|
|
|
|
},
|
|
|
|
"validate": {
|
|
|
|
"cel": {
|
|
|
|
"expressions": [
|
|
|
|
{
|
|
|
|
"expression": "!has(object.spec.volumes) || object.spec.volumes.all(volume, !has(volume.hostPath))"
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`),
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "policy-with-object-selector",
|
|
|
|
policy: []byte(`
|
|
|
|
{
|
|
|
|
"apiVersion": "kyverno.io/v1",
|
|
|
|
"kind": "ClusterPolicy",
|
|
|
|
"metadata": {
|
|
|
|
"name": "disallow-host-path"
|
|
|
|
},
|
|
|
|
"spec": {
|
|
|
|
"validationFailureAction": "Enforce",
|
|
|
|
"rules": [
|
|
|
|
{
|
|
|
|
"name": "host-path",
|
|
|
|
"match": {
|
|
|
|
"any": [
|
|
|
|
{
|
|
|
|
"resources": {
|
|
|
|
"kinds": [
|
|
|
|
"Deployment"
|
|
|
|
],
|
|
|
|
"operations": [
|
|
|
|
"CREATE",
|
|
|
|
"UPDATE"
|
|
|
|
],
|
|
|
|
"selector": {
|
|
|
|
"matchLabels": {
|
|
|
|
"app": "mongodb"
|
|
|
|
},
|
|
|
|
"matchExpressions": [
|
|
|
|
{
|
|
|
|
"key": "tier",
|
|
|
|
"operator": "In",
|
|
|
|
"values": [
|
|
|
|
"database"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
},
|
|
|
|
"validate": {
|
|
|
|
"cel": {
|
|
|
|
"expressions": [
|
|
|
|
{
|
|
|
|
"expression": "!has(object.spec.volumes) || object.spec.volumes.all(volume, !has(volume.hostPath))"
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`),
|
|
|
|
expected: true,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, test := range testCases {
|
|
|
|
t.Run(test.name, func(t *testing.T) {
|
2024-01-23 11:47:38 +00:00
|
|
|
policies, _, _, err := yamlutils.GetPolicy([]byte(test.policy))
|
2023-08-31 10:25:21 +00:00
|
|
|
assert.NilError(t, err)
|
|
|
|
assert.Equal(t, 1, len(policies))
|
2024-08-13 11:55:22 +00:00
|
|
|
out, _ := CanGenerateVAP(policies[0].GetSpec(), nil)
|
2023-08-31 10:25:21 +00:00
|
|
|
assert.Equal(t, out, test.expected)
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|