1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-28 10:28:36 +00:00

fix: remove unnecessary podSecurity chainsaw test (#9791)

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
This commit is contained in:
Mariam Fahmy 2024-02-26 08:23:34 +02:00 committed by GitHub
parent d737138ad5
commit 019fcaf377
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 0 additions and 134 deletions

View file

@ -1,7 +0,0 @@
## Description
This test ensures the PSS checks with the new advanced support on exclusions are applied to the resources successfully.
## Expected Behavior
Two pods (`good-pod` & `excluded-pod`) should be created as it follows the baseline:latest `/proc MountType` PSS check and one pod (`bad-pod`) should not be created as it violate the baseline:latest `/proc MountType` PSS check.

View file

@ -1,21 +0,0 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
procMount: unknown
initContainers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
procMount: other

View file

@ -1,24 +0,0 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
creationTimestamp: null
name: test-exclusion-procmount
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: step-02
try:
- apply:
expect:
- check:
($error != null): true
file: bad-pod.yaml
- apply:
file: excluded-pod.yaml
- apply:
file: good-pod.yaml

View file

@ -1,21 +0,0 @@
apiVersion: v1
kind: Pod
metadata:
name: excluded-pod
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
procMount: foo
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
procMount: bar

View file

@ -1,21 +0,0 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
procMount: default
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
procMount: default

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: test-exclusion-procmount
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -1,31 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: test-exclusion-procmount
spec:
background: true
validationFailureAction: Enforce
rules:
- name: test-exclusion-procmount
match:
any:
- resources:
kinds:
- Pod
validate:
podSecurity:
level: baseline
version: latest
exclude:
- controlName: "/proc Mount Type"
images:
- nginx
restrictedField: "spec.containers[*].securityContext.procMount"
values:
- "foo"
- controlName: "/proc Mount Type"
images:
- nginx
restrictedField: "spec.initContainers[*].securityContext.procMount"
values:
- "bar"