diff --git a/pkg/testrunner/testrunner_test.go b/pkg/testrunner/testrunner_test.go index cecf69c88b..a8fb494ee9 100644 --- a/pkg/testrunner/testrunner_test.go +++ b/pkg/testrunner/testrunner_test.go @@ -23,7 +23,7 @@ func Test_validate_deny_runasrootuser(t *testing.T) { } func Test_validate_disallow_priviledgedprivelegesecalation(t *testing.T) { - testScenario(t, "test/scenarios/test/scenario_validate_container_disallow_priviledgedprivelegesecalation.yaml") + testScenario(t, "test/scenarios/test/scenario_validate_disallow_priviledged_privelegesecalation.yaml") } func Test_validate_healthChecks(t *testing.T) { diff --git a/samples/README.md b/samples/README.md index 120b065cdd..5b5d7f4f60 100644 --- a/samples/README.md +++ b/samples/README.md @@ -2,7 +2,7 @@ | Best practice | Policy |------------------------------------------------|-----------------------------------------------------------------------| -| Run as non-root user | [policy_validate_deny_runasrootuser.yaml](best_practices/policy_validate_deny_runasrootuser.yaml) | +| Run as non-root user | [deny_runasrootuser.yaml](best_practices/deny_runasrootuser.yaml) | diff --git a/samples/best_practices/policy_validate_container_disallow_priviledgedprivelegesecalation.yaml b/samples/best_practices/disallow_priviledged_priviligedescalation.yaml similarity index 83% rename from samples/best_practices/policy_validate_container_disallow_priviledgedprivelegesecalation.yaml rename to samples/best_practices/disallow_priviledged_priviligedescalation.yaml index 4a54ba13cb..d266dc96c8 100644 --- a/samples/best_practices/policy_validate_container_disallow_priviledgedprivelegesecalation.yaml +++ b/samples/best_practices/disallow_priviledged_priviligedescalation.yaml @@ -1,11 +1,11 @@ apiVersion: kyverno.io/v1alpha1 kind: ClusterPolicy metadata: - name: validate-deny-privileged-disallowpriviligedescalation + name: validate-deny-privileged-priviligedescalation spec: validationFailureAction: "audit" rules: - - name: deny-privileged-disallowpriviligedescalation + - name: deny-privileged-priviligedescalation exclude: match: resources: diff --git a/examples/best_practices/resources/resource_validate_container_disallow_priviledgedprivelegesecalation.yaml b/test/manifest/disallow_priviledged_priviligedescalation.yaml similarity index 100% rename from examples/best_practices/resources/resource_validate_container_disallow_priviledgedprivelegesecalation.yaml rename to test/manifest/disallow_priviledged_priviligedescalation.yaml diff --git a/test/scenarios/test/scenario_validate_container_disallow_priviledgedprivelegesecalation.yaml b/test/scenarios/test/scenario_validate_container_disallow_priviledgedprivelegesecalation.yaml deleted file mode 100644 index 8ad99e102e..0000000000 --- a/test/scenarios/test/scenario_validate_container_disallow_priviledgedprivelegesecalation.yaml +++ /dev/null @@ -1,19 +0,0 @@ -# file path relative to project root -input: - policy: examples/best_practices/policy_validate_container_disallow_priviledgedprivelegesecalation.yaml - resource: examples/best_practices/resources/resource_validate_container_disallow_priviledgedprivelegesecalation.yaml -expected: - validation: - policyresponse: - policy: validate-deny-privileged-disallowpriviligedescalation - resource: - kind: Pod - apiVersion: v1 - namespace: '' - name: check-privileged-cfg - rules: - - name: deny-privileged-disallowpriviligedescalation - type: Validation - message: "Validation rule 'deny-privileged-disallowpriviligedescalation' failed to validate patterns defined in anyPattern. Privileged mode is not allowed. Set allowPrivilegeEscalation and privileged to false; anyPattern[0] failed at path /spec/securityContext/; anyPattern[1] failed at path /spec/containers/0/securityContext/allowPrivilegeEscalation/" - success: false - diff --git a/test/scenarios/test/scenario_validate_disallow_priviledged_privelegesecalation.yaml b/test/scenarios/test/scenario_validate_disallow_priviledged_privelegesecalation.yaml new file mode 100644 index 0000000000..db10c13be0 --- /dev/null +++ b/test/scenarios/test/scenario_validate_disallow_priviledged_privelegesecalation.yaml @@ -0,0 +1,19 @@ +# file path relative to project root +input: + policy: samples/best_practices/disallow_priviledged_priviligedescalation.yaml + resource: test/manifest/disallow_priviledged_priviligedescalation.yaml +expected: + validation: + policyresponse: + policy: validate-deny-privileged-priviligedescalation + resource: + kind: Pod + apiVersion: v1 + namespace: '' + name: check-privileged-cfg + rules: + - name: deny-privileged-priviligedescalation + type: Validation + message: "Validation rule 'deny-privileged-priviligedescalation' failed to validate patterns defined in anyPattern. Privileged mode is not allowed. Set allowPrivilegeEscalation and privileged to false; anyPattern[0] failed at path /spec/securityContext/; anyPattern[1] failed at path /spec/containers/0/securityContext/allowPrivilegeEscalation/" + success: false +