From 3e1ef320a8e110d5408507a24dd2fac1d87ea546 Mon Sep 17 00:00:00 2001
From: Shuting Zhao <shutting06@gmail.com>
Date: Wed, 9 Oct 2019 17:49:00 -0700
Subject: [PATCH] add require_probes.yaml

---
 examples/best_practices/README.md             |  4 ++--
 pkg/testrunner/testrunner_test.go             |  4 ++++
 samples/best_practices/require_probes.yaml    | 21 +++++++++++++++++++
 test/manifest/require_probes.yaml             | 12 +++++++++++
 .../test/scenario_validate_probes.yaml        | 18 ++++++++++++++++
 5 files changed, 57 insertions(+), 2 deletions(-)
 create mode 100644 samples/best_practices/require_probes.yaml
 create mode 100644 test/manifest/require_probes.yaml
 create mode 100644 test/scenarios/test/scenario_validate_probes.yaml

diff --git a/examples/best_practices/README.md b/examples/best_practices/README.md
index a2d965ecc3..650952714a 100644
--- a/examples/best_practices/README.md
+++ b/examples/best_practices/README.md
@@ -10,8 +10,8 @@
 | Require read only root filesystem              | [policy_validate_not_readonly_rootfilesystem.yaml](policy_validate_not_readonly_rootfilesystem.yaml)                     |      best_practices            |
 | Disallow node ports                            | [policy_validate_disallow_node_port.yaml](policy_validate_disallow_node_port.yaml)                           |      best_practices            |
 | Allow trusted registries                       | [policy_validate_whitelist_image_registries.yaml](policy_validate_whitelist_image_registries.yaml)                                                                               |
-| Require resource requests and limits           | [policy_validate_pod_resources.yaml](policy_validate_pod_resources.yaml)                                                                                     |
-| Require pod liveness and readiness probes      | [policy_validate_pod_probes.yaml](policy_validate_pod_probes.yaml)                                                                                           |
+| Require resource requests and limits           | [policy_validate_pod_resources.yaml](policy_validate_pod_resources.yaml)                                           |      best_practices            |
+| Require pod liveness and readiness probes      | [policy_validate_pod_probes.yaml](policy_validate_pod_probes.yaml)                                            |     best_practices            |
 | Require an image tag                           | [policy_validate_image_tag_notspecified_deny.yaml](policy_validate_image_tag_notspecified_deny.yaml)                                                         |
 | Disallow latest tag and pull IfNotPresent      | [policy_validate_image_latest_ifnotpresent_deny.yaml](policy_validate_image_latest_ifnotpresent_deny.yaml)                                                   |
 | Require a namespace (disallow default)         | [policy_validate_default_namespace.yaml](policy_validate_default_namespace.yaml)                                                                     |
diff --git a/pkg/testrunner/testrunner_test.go b/pkg/testrunner/testrunner_test.go
index 3a213b9fc3..edfde21019 100644
--- a/pkg/testrunner/testrunner_test.go
+++ b/pkg/testrunner/testrunner_test.go
@@ -143,3 +143,7 @@ func Test_validate_whitelist_image_registries(t *testing.T) {
 func Test_require_pod_requests_limits(t *testing.T) {
 	testScenario(t, "test/scenarios/test/scenario_validate_require_pod_requests_limits.yaml")
 }
+
+func Test_require_probes(t *testing.T) {
+	testScenario(t, "test/scenarios/test/scenario_validate_probes.yaml")
+}
diff --git a/samples/best_practices/require_probes.yaml b/samples/best_practices/require_probes.yaml
new file mode 100644
index 0000000000..9ab503ecac
--- /dev/null
+++ b/samples/best_practices/require_probes.yaml
@@ -0,0 +1,21 @@
+apiVersion: kyverno.io/v1alpha1
+kind: ClusterPolicy
+metadata:
+  name: validate-probes
+spec:
+  rules:
+  - name: check-probes
+    match:
+      resources:
+        kinds:
+        - Pod
+    validate:
+      message: "Liveness and readiness probes are required"
+      pattern:
+        spec:
+          containers:
+          - livenessProbe:
+              periodSeconds: ">0"      
+            readinessProbe:
+              periodSeconds: ">0"
+
diff --git a/test/manifest/require_probes.yaml b/test/manifest/require_probes.yaml
new file mode 100644
index 0000000000..4c967c6a43
--- /dev/null
+++ b/test/manifest/require_probes.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: myapp-pod
+  labels:
+    app: myapp
+spec: 
+  containers:
+  - name: nginx
+    image: nginx
+    readinessProbe:
+      periodSeconds: 5
\ No newline at end of file
diff --git a/test/scenarios/test/scenario_validate_probes.yaml b/test/scenarios/test/scenario_validate_probes.yaml
new file mode 100644
index 0000000000..a1dc71ac7f
--- /dev/null
+++ b/test/scenarios/test/scenario_validate_probes.yaml
@@ -0,0 +1,18 @@
+# file path relative to project root
+input:
+  policy: samples/best_practices/require_probes.yaml
+  resource: test/manifest/require_probes.yaml
+expected:
+  validation:
+    policyresponse:
+      policy: validate-probes
+      resource:
+        kind: Pod
+        apiVersion: v1
+        namespace: ''
+        name: myapp-pod
+      rules:
+        - name: check-probes
+          type: Validation
+          message: Validation rule 'check-probes' failed at '/spec/containers/0/livenessProbe/' for resource Pod//myapp-pod. Liveness and readiness probes are required
+          success: false