mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-28 10:28:36 +00:00
Code Activity

add policy_validate_not_readonly_rootfilesystem.yaml

Browse source
This commit is contained in:
Shuting Zhao 2019-09-09 18:13:38 -07:00
parent 3eeba1a32b
commit 3237f3d799
6 changed files with 57 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
examples/best_practices/README.md
View file

@ -7,7 +7,7 @@
| Disallow use of host networking and ports | [policy_validate_host_network_port.yaml](policy_validate_host_network_port.yaml) |
| Disallow use of host filesystem | [policy_validate_host_path.yaml](policy_validate_host_path.yaml) |
| Disallow hostPID and hostIPC | [policy_validate_hostPID_hosIPC.yaml](policy_validate_hostPID_hosIPC.yaml) |
| Require read only root filesystem | |
| Require read only root filesystem | [policy_validate_not_readonly_rootfilesystem.yaml](policy_validate_not_readonly_rootfilesystem.yaml) |
| Disallow node ports | |
| Allow trusted registries | [policy_validate_image_registries.yaml](policy_validate_image_registries.yaml) |
| Require resource requests and limits | [policy_validate_pod_resources.yaml](policy_validate_pod_resources.yaml) |

22
examples/best_practices/policy_validate_not_readonly_rootfilesystem.yaml Normal file
View file

@ -0,0 +1,22 @@
apiVersion: kyverno.io/v1alpha1
kind: ClusterPolicy
metadata:
name: validate-not-readonly-rootfilesystem
spec:
rules:
- name: validate-not-readonly-rootfilesystem
exclude:
resources:
namespaces:
- kube-system
match:
resources:
kinds:
- Pod
validate:
message: "Container should not have read-only rootfilesystem"
anyPattern:
- spec:
container:
- securityContext:
readOnlyRootFilesystem: false

10
examples/best_practices/resources/resource_validate_not_readonly_rootfilesystem.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: v1
kind: Pod
metadata:
name: ghost-with-readonly-rootfilesystem
spec:
containers:
- name: ghost
image: ghost
securityContext:
readOnlyRootFilesystem: true

4
pkg/testrunner/testrunner_test.go
View file

@ -95,3 +95,7 @@ func Test_validate_host_network_port(t *testing.T) {
func Test_validate_hostPID_hostIPC(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_hostpid_hostipc.yaml")
}
func Test_validate_not_readonly_rootfilesystem(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_not_readonly_rootfilesystem.yaml")
}

4
test/scenarios/test/scenario_validate_hostpid_hostipc.yaml
View file

@ -1,7 +1,7 @@
# file path relative to project root
input:
policy: examples/best_practices/policy_validate_hostPID_hosIPC.yaml
resource: examples/best_practices/resources/resource_validate_hostPID_hostIPC.yaml
policy: examples/best_practices/policy_validate_hostpid_hosipc.yaml
resource: examples/best_practices/resources/resource_validate_hostpid_hostipc.yaml
expected:
validation:
policyresponse:

18
test/scenarios/test/scenario_validate_not_readonly_rootfilesystem.yaml Normal file
View file

@ -0,0 +1,18 @@
# file path relative to project root
input:
policy: examples/best_practices/policy_validate_not_readonly_rootfilesystem.yaml
resource: examples/best_practices/resources/resource_validate_not_readonly_rootfilesystem.yaml
expected:
validation:
policyresponse:
policy: validate-not-readonly-rootfilesystem
resource:
kind: Pod
apiVersion: v1
namespace: ''
name: "ghost-with-readonly-rootfilesystem"
rules:
- name: validate-not-readonly-rootfilesystem
type: Validation
message: Validation rule 'validate-not-readonly-rootfilesystem' failed to validate patterns defined in anyPattern. Container should not have read-only rootfilesystem; anyPattern[0] failed at path /spec/container/
success: false