mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-29 10:55:05 +00:00
Code Activity

add require_image_tag_not_latest.yaml

Browse source
This commit is contained in:
Shuting Zhao 2019-10-09 18:35:07 -07:00
parent b5475fda5d
commit 4d29b461ff
8 changed files with 88 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
pkg/testrunner/testrunner_test.go
View file

@ -52,13 +52,13 @@ func Test_validate_image_latest_ifnotpresent_pass(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_image_latest_ifnotpresent_pass.yaml")
}
func Test_validate_image_tag_notspecified_deny(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_image_tag_notspecified_deny.yaml")
}
// func Test_validate_image_tag_notspecified_deny(t *testing.T) {
// testScenario(t, "test/scenarios/test/scenario_validate_image_tag_notspecified_deny.yaml")
// }
func Test_validate_image_tag_notspecified_pass(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_image_tag_notspecified_pass.yaml")
}
// func Test_validate_image_tag_notspecified_pass(t *testing.T) {
// testScenario(t, "test/scenarios/test/scenario_validate_image_tag_notspecified_pass.yaml")
// }
func Test_validate_image_pullpolicy_notalways_deny(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_image_pullpolicy_notalways_deny.yaml")
@ -68,12 +68,12 @@ func Test_validate_image_pullpolicy_notalways_pass(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_image_pullpolicy_notalways_pass.yaml")
}
func Test_validate_image_tag_latest_deny(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_image_tag_latest_deny.yaml")
func Test_validate_require_image_tag_not_latest_deny(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_valiadate_require_image_tag_not_latest_deny.yaml")
}
func Test_validate_image_tag_latest_pass(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_image_tag_latest_pass.yaml")
func Test_validate_require_image_tag_not_latest_pass(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_valiadate_require_image_tag_not_latest_pass.yaml")
}
func Test_mutate_pod_disable_automoutingapicred_pass(t *testing.T) {

28
samples/best_practices/require_image_tag_not_latest.yaml Normal file
View file

@ -0,0 +1,28 @@
apiVersion : kyverno.io/v1alpha1
kind: ClusterPolicy
metadata:
name: validate-image-tag
spec:
rules:
- name: image-tag-notspecified
match:
resources:
kinds:
- Pod
validate:
message: "image tag not specified"
pattern:
spec:
containers:
- image: "*:*"
- name: image-tag-not-latest
match:
resources:
kinds:
- Pod
validate:
message: "set image tag to a specific version"
pattern:
spec:
containers:
- image: "!*:latest"

10
test/manifest/require_image_tag_not_latest_deny.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: v1
kind: Pod
metadata:
name: myapp-pod
labels:
app: myapp
spec:
containers:
- name: nginx
image: nginx:latest

10
test/manifest/require_image_tag_not_latest_pass.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: v1
kind: Pod
metadata:
name: myapp-pod
labels:
app: myapp
spec:
containers:
- name: nginx
image: nginx:1.12

1
test/manifest/require_pod_requests_limits.yaml
View file

@ -11,5 +11,6 @@ spec:
resources:
requests:
memory: "256Mi"
cpu: "0.5"
limits:
memory: "256Mi"

22
test/scenarios/test/scenario_valiadate_require_image_tag_not_latest_deny.yaml Normal file
View file

@ -0,0 +1,22 @@
# file path relative to project root
input:
policy: samples/best_practices/require_image_tag_not_latest.yaml
resource: test/manifest/require_image_tag_not_latest_deny.yaml
expected:
validation:
policyresponse:
policy: validate-image-tag
resource:
kind: Pod
apiVersion: v1
namespace: ''
name: myapp-pod
rules:
- name: image-tag-notspecified
type: Validation
message: "Validation rule 'image-tag-notspecified' succesfully validated"
success: true
- name: image-tag-not-latest
type: Validation
message: "Validation rule 'image-tag-not-latest' failed at '/spec/containers/0/image/' for resource Pod//myapp-pod. set image tag to a specific version"
success: false

10
test/scenarios/test/scenario_validate_image_tag_notspecified_pass.yaml → test/scenarios/test/scenario_valiadate_require_image_tag_not_latest_pass.yaml
View file

@ -1,11 +1,11 @@
# file path relative to project root
input:
policy: examples/best_practices/policy_validate_image_tag_notspecified_deny.yaml
resource: examples/best_practices/resources/resource_validate_image_tag_notspecified_pass.yaml
policy: samples/best_practices/require_image_tag_not_latest.yaml
resource: examples/best_practices/resources/resource_validate_image_tag_latest_pass.yaml
expected:
validation:
policyresponse:
policy: validate-image-tag-notspecified
policy: validate-image-tag
resource:
kind: Pod
apiVersion: v1
@ -16,3 +16,7 @@ expected:
type: Validation
message: "Validation rule 'image-tag-notspecified' succesfully validated"
success: true
- name: image-tag-not-latest
type: Validation
message: "Validation rule 'image-tag-not-latest' succesfully validated"
success: true

18
test/scenarios/test/scenario_validate_image_tag_notspecified_deny.yaml
View file

@ -1,18 +0,0 @@
# file path relative to project root
input:
policy: examples/best_practices/policy_validate_image_tag_notspecified_deny.yaml
resource: examples/best_practices/resources/resource_validate_image_tag_notspecified_deny.yaml
expected:
validation:
policyresponse:
policy: validate-image-tag-notspecified
resource:
kind: Pod
apiVersion: v1
namespace: ''
name: myapp-pod
rules:
- name: image-tag-notspecified
type: Validation
message: "Validation rule 'image-tag-notspecified' failed at '/spec/containers/0/image/' for resource Pod//myapp-pod. image tag not specified"
success: false