mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-29 10:55:05 +00:00
Code Activity

update disallow_docker_sock_mount and disallow_host_network_port

Browse source
This commit is contained in:
Jim Bugwadia 2019-11-10 12:53:48 -08:00
parent fd1a26db29
commit 170e2a5179
5 changed files with 9 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
pkg/testrunner/testrunner_test.go
View file

@ -45,7 +45,7 @@ func Test_validate_disallow_default_namespace(t *testing.T) {
}
func Test_validate_host_network_port(t *testing.T) {
testScenario(t, "test/scenarios/samples/best_practices/scenario_validate_disallow_host_network_hostport.yaml")
testScenario(t, "test/scenarios/samples/best_practices/disallow_host_network_port.yaml")
}
func Test_validate_hostPID_hostIPC(t *testing.T) {
@ -117,7 +117,7 @@ func Test_validate_disallow_new_capabilities(t *testing.T) {
}
func Test_validate_disallow_docker_sock_mount(t *testing.T) {
testScenario(t, "test/scenarios/samples/best_practices/scenario_validate_disallow_docker_sock_mount.yaml")
testScenario(t, "test/scenarios/samples/best_practices/disallow_docker_sock_mount.yaml")
}
func Test_validate_disallow_helm_tiller(t *testing.T) {

8
samples/DisallowHostNetworkPort.md
View file

@ -5,23 +5,23 @@ Using `hostPort` and `hostNetwork` allows pods to share the host networking stac
## Policy YAML
[disallow_host_network_hostport.yaml](best_practices/disallow_host_network_hostport.yaml)
[disallow_host_network_port.yaml](best_practices/disallow_host_network_port.yaml)
````yaml
apiVersion: kyverno.io/v1alpha1
kind: ClusterPolicy
metadata:
name: validate-host-network-hostport
name: disallow-host-network-port
spec:
rules:
- name: validate-host-network-hostport
- name: validate-host-network-port
match:
resources:
kinds:
- Pod
validate:
message: "Defining hostNetwork and hostPort are not allowed"
message: "Using host networking is not allowed"
pattern:
spec:
(hostNetwork): false

2
samples/best_practices/disallow_host_network_hostport.yaml → samples/best_practices/disallow_host_network_port.yaml
View file

@ -8,7 +8,7 @@ metadata:
the host network stack, allowing potential snooping of network traffic from an application pod.
spec:
rules:
- name: validate-host-network-hostport
- name: validate-host-network-port
match:
resources:
kinds:

0
test/scenarios/samples/best_practices/scenario_validate_disallow_docker_sock_mount.yaml → test/scenarios/samples/best_practices/disallow_docker_sock_mount.yaml
View file

5
test/scenarios/samples/best_practices/scenario_validate_disallow_host_network_hostport.yaml → test/scenarios/samples/best_practices/disallow_host_network_port.yaml
View file

@ -1,6 +1,6 @@
# file path relative to project root
input:
policy: samples/best_practices/disallow_host_network_hostport.yaml
policy: samples/best_practices/disallow_host_network_port.yaml
resource: test/resources/disallow_host_network_hostport.yaml
expected:
validation:
@ -12,7 +12,6 @@ expected:
namespace: ''
name: "nginx-host-network"
rules:
- name: validate-host-network-hostport
- name: validate-host-network-port
type: Validation
message: "Validation error: Defining hostNetwork and hostPort are not allowed\nValidation rule 'validate-host-network-hostport' failed at path '/spec/containers/0/ports/0/hostPort/'."
success: false