mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-31 03:45:17 +00:00
add kuttl generate tests for Namespaced policy (#6662)
* [WIP] kuttl generate tests for Namespaced Policy Signed-off-by: yimikao <holayinkajr@gmail.com> * pol-clone-create-on-trigger-deletion Signed-off-by: yimikao <holayinkajr@gmail.com> * pol-data-sync-delete-trigger Signed-off-by: yimikao <holayinkajr@gmail.com> * pol-clone-sync-delete-trigger Signed-off-by: yimikao <holayinkajr@gmail.com> * pol-data-nosync-delete-trigger Signed-off-by: yimikao <holayinkajr@gmail.com> * pol-clone-nosync-delete-trigger Signed-off-by: yimikao <holayinkajr@gmail.com> * add change Signed-off-by: yimikao <holayinkajr@gmail.com> * pol-data-sync-update-trigger-no-match Signed-off-by: yimikao <holayinkajr@gmail.com> * remove file Signed-off-by: yimikao <holayinkajr@gmail.com> * pol-data-nosync-update-trigger-no-match Signed-off-by: yimikao <holayinkajr@gmail.com> * pol-clone-sync-update-trigger-no-match Signed-off-by: yimikao <holayinkajr@gmail.com> * pol-clone-nosync-update-trigger-no-match Signed-off-by: yimikao <holayinkajr@gmail.com> * corner cases Signed-off-by: yimikao <holayinkajr@gmail.com> * standard Signed-off-by: yimikao <holayinkajr@gmail.com> * remove failing test Signed-off-by: yimikao <holayinkajr@gmail.com> * sleep before assert Signed-off-by: yimikao <holayinkajr@gmail.com> * increase sleep dur Signed-off-by: yimikao <holayinkajr@gmail.com> * sleep before assert Signed-off-by: yimikao <holayinkajr@gmail.com> * use cm Signed-off-by: yimikao <holayinkajr@gmail.com> * fix cm name Signed-off-by: yimikao <holayinkajr@gmail.com> * use former resources Signed-off-by: yimikao <holayinkajr@gmail.com> * fix tests Signed-off-by: ShutingZhao <shuting@nirmata.com> --------- Signed-off-by: yimikao <holayinkajr@gmail.com> Signed-off-by: ShutingZhao <shuting@nirmata.com> Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> Co-authored-by: shuting <shuting@nirmata.com>
This commit is contained in:
yinka
GitHub
parent
18033a415b
commit
04c7b64ae7
84 changed files with 908 additions and 5 deletions
|
|
@ -31,11 +31,8 @@ spec:
|
||||||
- resources:
|
- resources:
|
||||||
kinds:
|
kinds:
|
||||||
- Namespace
|
- Namespace
|
||||||
preconditions:
|
operations:
|
||||||
any:
|
- DELETE
|
||||||
- key: "{{ request.operation }}"
|
|
||||||
operator: Equals
|
|
||||||
value: DELETE
|
|
||||||
generate:
|
generate:
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Secret
|
kind: Secret
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
apiVersion: kyverno.io/v1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-create-on-trigger-deletion-policy
|
||||||
|
namespace: pol-clone-create-on-trigger-deletion-ns
|
||||||
|
status:
|
||||||
|
conditions:
|
||||||
|
- reason: Succeeded
|
||||||
|
status: "True"
|
||||||
|
type: Ready
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-create-on-trigger-deletion-configmap
|
||||||
|
namespace: pol-clone-create-on-trigger-deletion-ns
|
||||||
|
|
@ -0,0 +1,40 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-create-on-trigger-deletion-ns
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-create-on-trigger-deletion-configmap
|
||||||
|
namespace: pol-clone-create-on-trigger-deletion-ns
|
||||||
|
data:
|
||||||
|
foo: bar
|
||||||
|
---
|
||||||
|
apiVersion: kyverno.io/v1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-create-on-trigger-deletion-policy
|
||||||
|
namespace: pol-clone-create-on-trigger-deletion-ns
|
||||||
|
spec:
|
||||||
|
rules:
|
||||||
|
- name: default-deny
|
||||||
|
match:
|
||||||
|
any:
|
||||||
|
- resources:
|
||||||
|
kinds:
|
||||||
|
- ConfigMap
|
||||||
|
operations:
|
||||||
|
- DELETE
|
||||||
|
generate:
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
name: pol-clone-create-on-trigger-deletion-netowrkpolicy
|
||||||
|
namespace: pol-clone-create-on-trigger-deletion-ns
|
||||||
|
synchronize: true
|
||||||
|
data:
|
||||||
|
spec:
|
||||||
|
podSelector: {}
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
# Specifying the kind as `TestStep` performs certain behaviors like this delete operation.
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
delete:
|
||||||
|
- apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
name: pol-clone-create-on-trigger-deletion-configmap
|
||||||
|
namespace: pol-clone-create-on-trigger-deletion-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
commands:
|
||||||
|
- command: sleep 3
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-create-on-trigger-deletion-netowrkpolicy
|
||||||
|
namespace: pol-clone-create-on-trigger-deletion-ns
|
||||||
|
spec:
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This is a corner case test to ensure a generate clone rule, with sync enabled, can be triggered on the deletion of the trigger resource.
|
||||||
|
|
||||||
|
## Expected Behavior
|
||||||
|
|
||||||
|
If the downstream resource is created, the test passes. If it is not created, the test fails.
|
||||||
|
|
||||||
|
## Reference Issue(s)
|
||||||
|
|
||||||
|
https://github.com/kyverno/kyverno/issues/6398
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
apiVersion: kyverno.io/v1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-create-on-trigger-deletion
|
||||||
|
namespace: pol-create-on-trigger-deletion-ns
|
||||||
|
status:
|
||||||
|
conditions:
|
||||||
|
- reason: Succeeded
|
||||||
|
status: "True"
|
||||||
|
type: Ready
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-create-on-trigger-deletion-ns
|
||||||
|
|
@ -0,0 +1,40 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: pol-create-on-trigger-deletion-ns
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-create-on-trigger-deletion-ns
|
||||||
|
data:
|
||||||
|
foo: bar
|
||||||
|
---
|
||||||
|
apiVersion: kyverno.io/v1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-create-on-trigger-deletion
|
||||||
|
namespace: pol-create-on-trigger-deletion-ns
|
||||||
|
spec:
|
||||||
|
rules:
|
||||||
|
- name: default-deny
|
||||||
|
match:
|
||||||
|
any:
|
||||||
|
- resources:
|
||||||
|
kinds:
|
||||||
|
- ConfigMap
|
||||||
|
operations:
|
||||||
|
- DELETE
|
||||||
|
generate:
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
name: default-deny
|
||||||
|
namespace: pol-create-on-trigger-deletion-ns
|
||||||
|
synchronize: true
|
||||||
|
data:
|
||||||
|
spec:
|
||||||
|
podSelector: {}
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
# Specifying the kind as `TestStep` performs certain behaviors like this delete operation.
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
delete:
|
||||||
|
- apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-create-on-trigger-deletion-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
commands:
|
||||||
|
- command: sleep 3
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: default-deny
|
||||||
|
namespace: pol-create-on-trigger-deletion-ns
|
||||||
|
spec:
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This is a corner case test to ensure a generate data rule, with sync enabled, can be triggered on the deletion of the trigger resource.
|
||||||
|
|
||||||
|
## Expected Behavior
|
||||||
|
|
||||||
|
If the downstream resource is created, the test passes. If it is not created, the test fails.
|
||||||
|
|
||||||
|
## Reference Issue(s)
|
||||||
|
|
||||||
|
https://github.com/kyverno/kyverno/issues/6398
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
apiVersion: kyverno.io/v2beta1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-nosync-delete-trigger-policy
|
||||||
|
namespace: pol-clone-nosync-delete-trigger-ns
|
||||||
|
status:
|
||||||
|
conditions:
|
||||||
|
- reason: Succeeded
|
||||||
|
status: "True"
|
||||||
|
type: Ready
|
||||||
|
|
@ -0,0 +1,36 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-nosync-delete-trigger-ns
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
foo: YmFy
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: source-secret
|
||||||
|
namespace: pol-clone-nosync-delete-trigger-ns
|
||||||
|
type: Opaque
|
||||||
|
---
|
||||||
|
apiVersion: kyverno.io/v2beta1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-nosync-delete-trigger-policy
|
||||||
|
namespace: pol-clone-nosync-delete-trigger-ns
|
||||||
|
spec:
|
||||||
|
rules:
|
||||||
|
- name: clone-secret
|
||||||
|
match:
|
||||||
|
any:
|
||||||
|
- resources:
|
||||||
|
kinds:
|
||||||
|
- ConfigMap
|
||||||
|
generate:
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
name: downstream-secret
|
||||||
|
namespace: pol-clone-nosync-delete-trigger-ns
|
||||||
|
synchronize: false
|
||||||
|
clone:
|
||||||
|
namespace: pol-clone-nosync-delete-trigger-ns
|
||||||
|
name: source-secret
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
apply:
|
||||||
|
- trigger.yaml
|
||||||
|
assert:
|
||||||
|
- downstream.yaml
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
# Specifying the kind as `TestStep` performs certain behaviors like this delete operation.
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
delete:
|
||||||
|
- apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-clone-nosync-delete-trigger-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
commands:
|
||||||
|
- command: sleep 3
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
assert:
|
||||||
|
- downstream.yaml
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This test checks to ensure that deletion of a trigger resource, with a generate clone declaration and sync disabled, does not result in the downstream resource's deletion.
|
||||||
|
|
||||||
|
## Expected Behavior
|
||||||
|
|
||||||
|
If the downstream resource is deleted, the test fails. If it remains, the test passes.
|
||||||
|
|
||||||
|
## Reference Issue(s)
|
||||||
|
|
||||||
|
https://github.com/kyverno/kyverno/issues/2229
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
foo: YmFy
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: downstream-secret
|
||||||
|
namespace: pol-clone-nosync-delete-trigger-ns
|
||||||
|
type: Opaque
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-clone-nosync-delete-trigger-ns
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
apiVersion: kyverno.io/v2beta1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-nosync-update-trigger-no-match-policy
|
||||||
|
namespace: pol-clone-nosync-update-trigger-no-match-ns
|
||||||
|
status:
|
||||||
|
conditions:
|
||||||
|
- reason: Succeeded
|
||||||
|
status: "True"
|
||||||
|
type: Ready
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-nosync-update-trigger-no-match-ns
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
foo: YmFy
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: source-secret
|
||||||
|
namespace: pol-clone-nosync-update-trigger-no-match-ns
|
||||||
|
type: Opaque
|
||||||
|
---
|
||||||
|
apiVersion: kyverno.io/v2beta1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-nosync-update-trigger-no-match-policy
|
||||||
|
namespace: pol-clone-nosync-update-trigger-no-match-ns
|
||||||
|
spec:
|
||||||
|
rules:
|
||||||
|
- name: clone-secret
|
||||||
|
match:
|
||||||
|
any:
|
||||||
|
- resources:
|
||||||
|
kinds:
|
||||||
|
- ConfigMap
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
create-secret: "true"
|
||||||
|
generate:
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
name: downstream-secret
|
||||||
|
namespace: pol-clone-nosync-update-trigger-no-match-ns
|
||||||
|
synchronize: false
|
||||||
|
clone:
|
||||||
|
namespace: pol-clone-nosync-update-trigger-no-match-ns
|
||||||
|
name: source-secret
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
create-secret: "true"
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-clone-nosync-update-trigger-no-match-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
assert:
|
||||||
|
- downstream.yaml
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
create-secret: "false"
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-clone-nosync-update-trigger-no-match-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
commands:
|
||||||
|
- command: sleep 3
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
assert:
|
||||||
|
- downstream.yaml
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This test checks to ensure that updates to a trigger which cause it to no longer match the rule, with a generate clone declaration and sync disabled, does not result in the downstream resource's deletion.
|
||||||
|
|
||||||
|
## Expected Behavior
|
||||||
|
|
||||||
|
If the downstream resource is deleted, the test fails. If it remains, the test passes.
|
||||||
|
|
||||||
|
## Reference Issue(s)
|
||||||
|
|
||||||
|
https://github.com/kyverno/kyverno/issues/6507
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
foo: YmFy
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: downstream-secret
|
||||||
|
namespace: pol-clone-nosync-update-trigger-no-match-ns
|
||||||
|
type: Opaque
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
apiVersion: kyverno.io/v2beta1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-sync-delete-trigger-policy
|
||||||
|
namespace: pol-clone-sync-delete-trigger-ns
|
||||||
|
status:
|
||||||
|
conditions:
|
||||||
|
- reason: Succeeded
|
||||||
|
status: "True"
|
||||||
|
type: Ready
|
||||||
|
|
@ -0,0 +1,36 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-sync-delete-trigger-ns
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
foo: YmFy
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: source-secret
|
||||||
|
namespace: pol-clone-sync-delete-trigger-ns
|
||||||
|
type: Opaque
|
||||||
|
---
|
||||||
|
apiVersion: kyverno.io/v2beta1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-sync-delete-trigger-policy
|
||||||
|
namespace: pol-clone-sync-delete-trigger-ns
|
||||||
|
spec:
|
||||||
|
rules:
|
||||||
|
- name: clone-secret
|
||||||
|
match:
|
||||||
|
any:
|
||||||
|
- resources:
|
||||||
|
kinds:
|
||||||
|
- ConfigMap
|
||||||
|
generate:
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
name: downstream-secret
|
||||||
|
namespace: pol-clone-sync-delete-trigger-ns
|
||||||
|
synchronize: true
|
||||||
|
clone:
|
||||||
|
namespace: pol-clone-sync-delete-trigger-ns
|
||||||
|
name: source-secret
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
apply:
|
||||||
|
- trigger.yaml
|
||||||
|
assert:
|
||||||
|
- downstream.yaml
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
# Specifying the kind as `TestStep` performs certain behaviors like this delete operation.
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
delete:
|
||||||
|
- apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-clone-sync-delete-trigger-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
commands:
|
||||||
|
- command: sleep 3
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
error:
|
||||||
|
- downstream.yaml
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This test checks to ensure that deletion of a trigger resource, with a generate clone declaration and sync enabled, results in the downstream resource's deletion.
|
||||||
|
|
||||||
|
## Expected Behavior
|
||||||
|
|
||||||
|
If the downstream resource is deleted, the test passes. If it remains, the test fails.
|
||||||
|
|
||||||
|
## Reference Issue(s)
|
||||||
|
|
||||||
|
https://github.com/kyverno/kyverno/issues/2229
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
foo: YmFy
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: downstream-secret
|
||||||
|
namespace: pol-clone-sync-delete-trigger-ns
|
||||||
|
type: Opaque
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-clone-sync-delete-trigger-ns
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
apiVersion: kyverno.io/v2beta1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-sync-update-trigger-no-match-policy
|
||||||
|
namespace: pol-clone-sync-update-trigger-no-match-ns
|
||||||
|
status:
|
||||||
|
conditions:
|
||||||
|
- reason: Succeeded
|
||||||
|
status: "True"
|
||||||
|
type: Ready
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-sync-update-trigger-no-match-ns
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
foo: YmFy
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: source-secret
|
||||||
|
namespace: pol-clone-sync-update-trigger-no-match-ns
|
||||||
|
type: Opaque
|
||||||
|
---
|
||||||
|
apiVersion: kyverno.io/v2beta1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-clone-sync-update-trigger-no-match-policy
|
||||||
|
namespace: pol-clone-sync-update-trigger-no-match-ns
|
||||||
|
spec:
|
||||||
|
rules:
|
||||||
|
- name: clone-secret
|
||||||
|
match:
|
||||||
|
any:
|
||||||
|
- resources:
|
||||||
|
kinds:
|
||||||
|
- ConfigMap
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
create-secret: "true"
|
||||||
|
generate:
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
name: downstream-secret
|
||||||
|
namespace: pol-clone-sync-update-trigger-no-match-ns
|
||||||
|
synchronize: true
|
||||||
|
clone:
|
||||||
|
namespace: pol-clone-sync-update-trigger-no-match-ns
|
||||||
|
name: source-secret
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
create-secret: "true"
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-clone-sync-update-trigger-no-match-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
assert:
|
||||||
|
- downstream.yaml
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
create-secret: "false"
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-clone-sync-update-trigger-no-match-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
commands:
|
||||||
|
- command: sleep 3
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
error:
|
||||||
|
- downstream.yaml
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This test checks to ensure that updates to a trigger which cause it to no longer match the rule, with a generate clone declaration and sync enabled, results in the downstream resource's deletion.
|
||||||
|
|
||||||
|
## Expected Behavior
|
||||||
|
|
||||||
|
If the downstream resource is deleted, the test passes. If it remains, the test fails.
|
||||||
|
|
||||||
|
## Reference Issue(s)
|
||||||
|
|
||||||
|
https://github.com/kyverno/kyverno/issues/6507
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
foo: YmFy
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: downstream-secret
|
||||||
|
namespace: pol-clone-sync-update-trigger-no-match-ns
|
||||||
|
type: Opaque
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
apiVersion: kyverno.io/v2beta1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-data-nosync-delete-trigger
|
||||||
|
namespace: pol-data-nosync-delete-trigger-ns
|
||||||
|
status:
|
||||||
|
conditions:
|
||||||
|
- reason: Succeeded
|
||||||
|
status: "True"
|
||||||
|
type: Ready
|
||||||
|
|
@ -0,0 +1,30 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: pol-data-nosync-delete-trigger-ns
|
||||||
|
---
|
||||||
|
apiVersion: kyverno.io/v1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-data-nosync-delete-trigger
|
||||||
|
namespace: pol-data-nosync-delete-trigger-ns
|
||||||
|
spec:
|
||||||
|
rules:
|
||||||
|
- name: default-deny
|
||||||
|
match:
|
||||||
|
any:
|
||||||
|
- resources:
|
||||||
|
kinds:
|
||||||
|
- ConfigMap
|
||||||
|
generate:
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
name: default-deny
|
||||||
|
namespace: pol-data-nosync-delete-trigger-ns
|
||||||
|
synchronize: false
|
||||||
|
data:
|
||||||
|
spec:
|
||||||
|
podSelector: {}
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-data-nosync-delete-trigger-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
assert:
|
||||||
|
- downstream.yaml
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
# Specifying the kind as `TestStep` performs certain behaviors like this delete operation.
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
delete:
|
||||||
|
- apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-data-nosync-delete-trigger-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
commands:
|
||||||
|
- command: sleep 3
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
assert:
|
||||||
|
- downstream.yaml
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This test checks to ensure that deletion of a trigger resource, with a generate data declaration and sync disabled, doesn't result in the downstream resource's deletion.
|
||||||
|
|
||||||
|
## Expected Behavior
|
||||||
|
|
||||||
|
If the downstream resource is deleted, the test fails. If it remains, the test passes.
|
||||||
|
|
||||||
|
## Reference Issue(s)
|
||||||
|
|
||||||
|
https://github.com/kyverno/kyverno/issues/2229
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: default-deny
|
||||||
|
namespace: pol-data-nosync-delete-trigger-ns
|
||||||
|
spec:
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
apiVersion: kyverno.io/v2beta1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-data-nosync-update-trigger-no-match
|
||||||
|
namespace: pol-data-nosync-update-trigger-no-match-ns
|
||||||
|
status:
|
||||||
|
conditions:
|
||||||
|
- reason: Succeeded
|
||||||
|
status: "True"
|
||||||
|
type: Ready
|
||||||
|
|
@ -0,0 +1,33 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: pol-data-nosync-update-trigger-no-match-ns
|
||||||
|
---
|
||||||
|
apiVersion: kyverno.io/v1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-data-nosync-update-trigger-no-match
|
||||||
|
namespace: pol-data-nosync-update-trigger-no-match-ns
|
||||||
|
spec:
|
||||||
|
rules:
|
||||||
|
- name: default-deny
|
||||||
|
match:
|
||||||
|
any:
|
||||||
|
- resources:
|
||||||
|
kinds:
|
||||||
|
- ConfigMap
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
create-netpol: "true"
|
||||||
|
generate:
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
name: default-deny
|
||||||
|
namespace: pol-data-nosync-update-trigger-no-match-ns
|
||||||
|
synchronize: false
|
||||||
|
data:
|
||||||
|
spec:
|
||||||
|
podSelector: {}
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
create-netpol: "true"
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-data-nosync-update-trigger-no-match-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
assert:
|
||||||
|
- downstream.yaml
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
create-netpol: "false"
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-data-nosync-update-trigger-no-match-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
commands:
|
||||||
|
- command: sleep 3
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
assert:
|
||||||
|
- downstream.yaml
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This test checks to ensure that updates to a trigger which cause it to no longer match the rule, with a generate data declaration and sync disabled, does not result in the downstream resource's deletion.
|
||||||
|
|
||||||
|
## Expected Behavior
|
||||||
|
|
||||||
|
If the downstream resource remains, the test passes. If it is deleted, the test fails.
|
||||||
|
|
||||||
|
## Reference Issue(s)
|
||||||
|
|
||||||
|
https://github.com/kyverno/kyverno/issues/6507
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: default-deny
|
||||||
|
namespace: pol-data-nosync-update-trigger-no-match-ns
|
||||||
|
spec:
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
|
@ -0,0 +1,30 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: pol-data-sync-delete-trigger-ns
|
||||||
|
---
|
||||||
|
apiVersion: kyverno.io/v1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-data-sync-delete-trigger
|
||||||
|
namespace: pol-data-sync-delete-trigger-ns
|
||||||
|
spec:
|
||||||
|
rules:
|
||||||
|
- name: default-deny
|
||||||
|
match:
|
||||||
|
any:
|
||||||
|
- resources:
|
||||||
|
kinds:
|
||||||
|
- ConfigMap
|
||||||
|
generate:
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
name: default-deny
|
||||||
|
namespace: pol-data-sync-delete-trigger-ns
|
||||||
|
synchronize: true
|
||||||
|
data:
|
||||||
|
spec:
|
||||||
|
podSelector: {}
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-data-sync-delete-trigger-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
commands:
|
||||||
|
- command: sleep 5
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
apiVersion: kyverno.io/v1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-data-sync-delete-trigger
|
||||||
|
namespace: pol-data-sync-delete-trigger-ns
|
||||||
|
status:
|
||||||
|
conditions:
|
||||||
|
- reason: Succeeded
|
||||||
|
status: "True"
|
||||||
|
type: Ready
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-data-sync-delete-trigger-ns
|
||||||
|
---
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: default-deny
|
||||||
|
namespace: pol-data-sync-delete-trigger-ns
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
# Specifying the kind as `TestStep` performs certain behaviors like this delete operation.
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
delete:
|
||||||
|
- apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-data-sync-delete-trigger-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
commands:
|
||||||
|
- command: sleep 3
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: default-deny
|
||||||
|
namespace: pol-data-sync-delete-trigger-ns
|
||||||
|
spec:
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This test checks to ensure that deletion of a trigger resource, with a generate data declaration and sync enabled, results in the downstream resource's deletion.
|
||||||
|
|
||||||
|
## Expected Behavior
|
||||||
|
|
||||||
|
If the downstream resource is deleted, the test passes. If it remains, the test fails.
|
||||||
|
|
||||||
|
## Reference Issue(s)
|
||||||
|
|
||||||
|
https://github.com/kyverno/kyverno/issues/2229
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
apiVersion: kyverno.io/v2beta1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-data-sync-update-trigger-no-match
|
||||||
|
namespace: pol-data-sync-update-trigger-no-match-ns
|
||||||
|
status:
|
||||||
|
conditions:
|
||||||
|
- reason: Succeeded
|
||||||
|
status: "True"
|
||||||
|
type: Ready
|
||||||
|
|
@ -0,0 +1,33 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: pol-data-sync-update-trigger-no-match-ns
|
||||||
|
---
|
||||||
|
apiVersion: kyverno.io/v1
|
||||||
|
kind: Policy
|
||||||
|
metadata:
|
||||||
|
name: pol-data-sync-update-trigger-no-match
|
||||||
|
namespace: pol-data-sync-update-trigger-no-match-ns
|
||||||
|
spec:
|
||||||
|
rules:
|
||||||
|
- name: default-deny
|
||||||
|
match:
|
||||||
|
any:
|
||||||
|
- resources:
|
||||||
|
kinds:
|
||||||
|
- ConfigMap
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
create-netpol: "true"
|
||||||
|
generate:
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
name: default-deny
|
||||||
|
namespace: pol-data-sync-update-trigger-no-match-ns
|
||||||
|
synchronize: true
|
||||||
|
data:
|
||||||
|
spec:
|
||||||
|
podSelector: {}
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
create-netpol: "true"
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-data-sync-update-trigger-no-match-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
assert:
|
||||||
|
- downstream.yaml
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
create-netpol: "false"
|
||||||
|
name: test-org
|
||||||
|
namespace: pol-data-sync-update-trigger-no-match-ns
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
commands:
|
||||||
|
- command: sleep 3
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: kuttl.dev/v1beta1
|
||||||
|
kind: TestStep
|
||||||
|
error:
|
||||||
|
- downstream.yaml
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This test checks to ensure that updates to a trigger which cause it to no longer match the rule, with a generate data declaration and sync enabled, results in the downstream resource's deletion.
|
||||||
|
|
||||||
|
## Expected Behavior
|
||||||
|
|
||||||
|
If the downstream resource is deleted, the test passes. If it remains, the test fails.
|
||||||
|
|
||||||
|
## Reference Issue(s)
|
||||||
|
|
||||||
|
https://github.com/kyverno/kyverno/issues/6507
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: default-deny
|
||||||
|
namespace: pol-data-sync-update-trigger-no-match-ns
|
||||||
|
spec:
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
Loading…
Add table
Reference in a new issue