add disallow_priviledged_privelegesecalation.yaml

pkg/testrunner/testrunner_test.go

@@ -23,7 +23,7 @@ func Test_validate_deny_runasrootuser(t *testing.T) {
 }
 
 func Test_validate_disallow_priviledgedprivelegesecalation(t *testing.T) {
-	testScenario(t, "test/scenarios/test/scenario_validate_container_disallow_priviledgedprivelegesecalation.yaml")
+	testScenario(t, "test/scenarios/test/scenario_validate_disallow_priviledged_privelegesecalation.yaml")
 }
 
 func Test_validate_healthChecks(t *testing.T) {

samples/README.md

@@ -2,7 +2,7 @@
 
 | Best practice                                  | Policy
 |------------------------------------------------|-----------------------------------------------------------------------|
-| Run as non-root user              | [policy_validate_deny_runasrootuser.yaml](best_practices/policy_validate_deny_runasrootuser.yaml)                    |
+| Run as non-root user              | [deny_runasrootuser.yaml](best_practices/deny_runasrootuser.yaml)                    |
 
 
 

samples/best_practices/disallow_priviledged_priviligedescalation.yaml

@@ -1,11 +1,11 @@
 apiVersion: kyverno.io/v1alpha1
 kind: ClusterPolicy
 metadata:
-  name: validate-deny-privileged-disallowpriviligedescalation
+  name: validate-deny-privileged-priviligedescalation
 spec:
   validationFailureAction: "audit"
   rules:
-  - name: deny-privileged-disallowpriviligedescalation
+  - name: deny-privileged-priviligedescalation
     exclude:
     match:
       resources:

test/scenarios/test/scenario_validate_container_disallow_priviledgedprivelegesecalation.yaml

@@ -1,19 +0,0 @@
-# file path relative to project root
-input:
-  policy: examples/best_practices/policy_validate_container_disallow_priviledgedprivelegesecalation.yaml
-  resource: examples/best_practices/resources/resource_validate_container_disallow_priviledgedprivelegesecalation.yaml
-expected:
-  validation:
-    policyresponse:
-      policy: validate-deny-privileged-disallowpriviligedescalation
-      resource:
-        kind: Pod
-        apiVersion: v1
-        namespace: ''
-        name: check-privileged-cfg
-      rules:
-        - name: deny-privileged-disallowpriviligedescalation
-          type: Validation
-          message: "Validation rule 'deny-privileged-disallowpriviligedescalation' failed to validate patterns defined in anyPattern. Privileged mode is not allowed. Set allowPrivilegeEscalation and privileged to false; anyPattern[0] failed at path /spec/securityContext/; anyPattern[1] failed at path /spec/containers/0/securityContext/allowPrivilegeEscalation/"
-          success: false
-

test/scenarios/test/scenario_validate_disallow_priviledged_privelegesecalation.yaml

@@ -0,0 +1,19 @@
+# file path relative to project root
+input:
+  policy: samples/best_practices/disallow_priviledged_priviligedescalation.yaml
+  resource: test/manifest/disallow_priviledged_priviligedescalation.yaml
+expected:
+  validation:
+    policyresponse:
+      policy: validate-deny-privileged-priviligedescalation
+      resource:
+        kind: Pod
+        apiVersion: v1
+        namespace: ''
+        name: check-privileged-cfg
+      rules:
+        - name: deny-privileged-priviligedescalation
+          type: Validation
+          message: "Validation rule 'deny-privileged-priviligedescalation' failed to validate patterns defined in anyPattern. Privileged mode is not allowed. Set allowPrivilegeEscalation and privileged to false; anyPattern[0] failed at path /spec/securityContext/; anyPattern[1] failed at path /spec/containers/0/securityContext/allowPrivilegeEscalation/"
+          success: false
+