mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-29 10:55:05 +00:00
Code Activity

best practice: validate container capability

Browse source
This commit is contained in:
Shuting Zhao 2019-10-04 18:15:39 -07:00
parent 0c09ba53eb
commit 2243e9e2e7
5 changed files with 56 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
examples/best_practices/README.md
View file

@ -21,4 +21,5 @@
| Require namespace quotas and limit ranges | [policy_validate_namespace_quota.yaml](policy_validate_namespace_quota.yaml) |
| Allow an FSGroup that owns the pod's volumes | [policy_validate_fsgroup.yaml](policy_validate_fsgroup.yaml) |
| Require SELinux level of the container | [policy_validate_selinux_context.yaml](policy_validate_selinux_context.yaml) |
| Allow default Proc Mount type | [policy_validate_default_proc_mount.yaml](policy_validate_default_proc_mount.yaml) |
| Allow default Proc Mount type | [policy_validate_default_proc_mount.yaml](policy_validate_default_proc_mount.yaml) |
| Allow certain capability to be added | [policy_validate_container_capabilities.yaml](policy_validate_container_capabilities.yaml) |

20
examples/best_practices/policy_validate_container_capabilities.yaml Normal file
View file

@ -0,0 +1,20 @@
apiVersion: kyverno.io/v1alpha1
kind: ClusterPolicy
metadata:
name: validate-container-capablities
spec:
validationFailureAction: "audit"
rules:
- name: validate-container-capablities
match:
resources:
kinds:
- Pod
validate:
message: "Allow certain capability to be added"
pattern:
spec:
containers:
- securityContext:
capabilities:
add: ["NET_ADMIN"]

11
examples/best_practices/resources/resource_validate_container_capabilities.yaml Normal file
View file

@ -0,0 +1,11 @@
apiVersion: v1
kind: Pod
metadata:
name: add-capabilities
spec:
containers:
- name: add-capabilities
image: gcr.io/google-samples/node-hello:1.0
securityContext:
capabilities:
add: ["SYS_TIME"]

4
pkg/testrunner/testrunner_test.go
View file

@ -123,3 +123,7 @@ func Test_validate_selinux_context(t *testing.T) {
func Test_validate_proc_mount(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_default_proc_mount.yaml")
}
func Test_validate_container_capabilities(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_container_capabilities.yaml")
}

19
test/scenarios/test/scenario_validate_container_capabilities.yaml Normal file
View file

@ -0,0 +1,19 @@
# file path relative to project root
input:
policy: examples/best_practices/policy_validate_container_capabilities.yaml
resource: examples/best_practices/resources/resource_validate_container_capabilities.yaml
expected:
validation:
policyresponse:
policy: validate-container-capablities
resource:
kind: Pod
apiVersion: v1
namespace: ''
name: add-capabilities
rules:
- name: validate-container-capablities
type: Validation
message: "Validation rule 'validate-container-capablities' failed at '/spec/containers/0/securityContext/capabilities/add/0/' for resource Pod//add-capabilities. Allow certain capability to be added"
success: false