mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-28 10:28:36 +00:00
fix: remove unnecessary podSecurity chainsaw test (#9791)
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
This commit is contained in:
parent
d737138ad5
commit
019fcaf377
7 changed files with 0 additions and 134 deletions
|
@ -1,7 +0,0 @@
|
|||
## Description
|
||||
|
||||
This test ensures the PSS checks with the new advanced support on exclusions are applied to the resources successfully.
|
||||
|
||||
## Expected Behavior
|
||||
|
||||
Two pods (`good-pod` & `excluded-pod`) should be created as it follows the baseline:latest `/proc MountType` PSS check and one pod (`bad-pod`) should not be created as it violate the baseline:latest `/proc MountType` PSS check.
|
|
@ -1,21 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: bad-pod
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx1
|
||||
image: nginx
|
||||
args:
|
||||
- sleep
|
||||
- 1d
|
||||
securityContext:
|
||||
procMount: unknown
|
||||
initContainers:
|
||||
- name: nginx1
|
||||
image: nginx
|
||||
args:
|
||||
- sleep
|
||||
- 1d
|
||||
securityContext:
|
||||
procMount: other
|
|
@ -1,24 +0,0 @@
|
|||
apiVersion: chainsaw.kyverno.io/v1alpha1
|
||||
kind: Test
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: test-exclusion-procmount
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
expect:
|
||||
- check:
|
||||
($error != null): true
|
||||
file: bad-pod.yaml
|
||||
- apply:
|
||||
file: excluded-pod.yaml
|
||||
- apply:
|
||||
file: good-pod.yaml
|
|
@ -1,21 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: excluded-pod
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx1
|
||||
image: nginx
|
||||
args:
|
||||
- sleep
|
||||
- 1d
|
||||
securityContext:
|
||||
procMount: foo
|
||||
initContainers:
|
||||
- name: nginx2
|
||||
image: nginx
|
||||
args:
|
||||
- sleep
|
||||
- 1d
|
||||
securityContext:
|
||||
procMount: bar
|
|
@ -1,21 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: good-pod
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx1
|
||||
image: nginx
|
||||
args:
|
||||
- sleep
|
||||
- 1d
|
||||
securityContext:
|
||||
procMount: default
|
||||
initContainers:
|
||||
- name: nginx2
|
||||
image: nginx
|
||||
args:
|
||||
- sleep
|
||||
- 1d
|
||||
securityContext:
|
||||
procMount: default
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: test-exclusion-procmount
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -1,31 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: test-exclusion-procmount
|
||||
spec:
|
||||
background: true
|
||||
validationFailureAction: Enforce
|
||||
rules:
|
||||
- name: test-exclusion-procmount
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
podSecurity:
|
||||
level: baseline
|
||||
version: latest
|
||||
exclude:
|
||||
- controlName: "/proc Mount Type"
|
||||
images:
|
||||
- nginx
|
||||
restrictedField: "spec.containers[*].securityContext.procMount"
|
||||
values:
|
||||
- "foo"
|
||||
- controlName: "/proc Mount Type"
|
||||
images:
|
||||
- nginx
|
||||
restrictedField: "spec.initContainers[*].securityContext.procMount"
|
||||
values:
|
||||
- "bar"
|
Loading…
Add table
Reference in a new issue