add require_image_tag_not_latest.yaml

pkg/testrunner/testrunner_test.go

@@ -52,13 +52,13 @@ func Test_validate_image_latest_ifnotpresent_pass(t *testing.T) {
 	testScenario(t, "test/scenarios/test/scenario_validate_image_latest_ifnotpresent_pass.yaml")
 }
 
-func Test_validate_image_tag_notspecified_deny(t *testing.T) {
+// func Test_validate_image_tag_notspecified_deny(t *testing.T) {
-	testScenario(t, "test/scenarios/test/scenario_validate_image_tag_notspecified_deny.yaml")
+// 	testScenario(t, "test/scenarios/test/scenario_validate_image_tag_notspecified_deny.yaml")
-}
+// }
 
-func Test_validate_image_tag_notspecified_pass(t *testing.T) {
+// func Test_validate_image_tag_notspecified_pass(t *testing.T) {
-	testScenario(t, "test/scenarios/test/scenario_validate_image_tag_notspecified_pass.yaml")
+// 	testScenario(t, "test/scenarios/test/scenario_validate_image_tag_notspecified_pass.yaml")
-}
+// }
 
 func Test_validate_image_pullpolicy_notalways_deny(t *testing.T) {
 	testScenario(t, "test/scenarios/test/scenario_validate_image_pullpolicy_notalways_deny.yaml")
@@ -68,12 +68,12 @@ func Test_validate_image_pullpolicy_notalways_pass(t *testing.T) {
 	testScenario(t, "test/scenarios/test/scenario_validate_image_pullpolicy_notalways_pass.yaml")
 }
 
-func Test_validate_image_tag_latest_deny(t *testing.T) {
+func Test_validate_require_image_tag_not_latest_deny(t *testing.T) {
-	testScenario(t, "test/scenarios/test/scenario_validate_image_tag_latest_deny.yaml")
+	testScenario(t, "test/scenarios/test/scenario_valiadate_require_image_tag_not_latest_deny.yaml")
 }
 
-func Test_validate_image_tag_latest_pass(t *testing.T) {
+func Test_validate_require_image_tag_not_latest_pass(t *testing.T) {
-	testScenario(t, "test/scenarios/test/scenario_validate_image_tag_latest_pass.yaml")
+	testScenario(t, "test/scenarios/test/scenario_valiadate_require_image_tag_not_latest_pass.yaml")
 }
 
 func Test_mutate_pod_disable_automoutingapicred_pass(t *testing.T) {

samples/best_practices/require_image_tag_not_latest.yaml

@@ -0,0 +1,28 @@
+apiVersion : kyverno.io/v1alpha1
+kind: ClusterPolicy
+metadata:
+  name: validate-image-tag
+spec:
+  rules:
+  - name: image-tag-notspecified
+    match:
+      resources:
+        kinds:
+        - Pod
+    validate:
+      message: "image tag not specified"  
+      pattern:
+        spec:
+          containers:
+          - image: "*:*"
+  - name: image-tag-not-latest
+    match:
+      resources:
+        kinds:
+        - Pod
+    validate:
+      message: "set image tag to a specific version"
+      pattern:
+        spec:
+          containers:
+          - image: "!*:latest"

test/manifest/require_image_tag_not_latest_deny.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: myapp-pod
+  labels:
+    app: myapp
+spec: 
+  containers:
+  - name: nginx
+    image: nginx:latest

test/manifest/require_image_tag_not_latest_pass.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: myapp-pod
+  labels:
+    app: myapp
+spec: 
+  containers:
+  - name: nginx
+    image: nginx:1.12

test/manifest/require_pod_requests_limits.yaml

@@ -11,5 +11,6 @@ spec:
     resources:
       requests:
         memory: "256Mi"
+        cpu: "0.5"
       limits:
         memory: "256Mi"

test/scenarios/test/scenario_valiadate_require_image_tag_not_latest_deny.yaml

@@ -0,0 +1,22 @@
+# file path relative to project root
+input:
+  policy: samples/best_practices/require_image_tag_not_latest.yaml
+  resource: test/manifest/require_image_tag_not_latest_deny.yaml
+expected:
+  validation:
+    policyresponse:
+      policy: validate-image-tag
+      resource:
+        kind: Pod
+        apiVersion: v1
+        namespace: ''
+        name: myapp-pod
+      rules:
+        - name: image-tag-notspecified
+          type: Validation
+          message: "Validation rule 'image-tag-notspecified' succesfully validated"
+          success: true
+        - name: image-tag-not-latest
+          type: Validation
+          message: "Validation rule 'image-tag-not-latest' failed at '/spec/containers/0/image/' for resource Pod//myapp-pod. set image tag to a specific version"
+          success: false   

test/scenarios/test/scenario_valiadate_require_image_tag_not_latest_pass.yaml

@@ -1,11 +1,11 @@
 # file path relative to project root
 input:
-  policy: examples/best_practices/policy_validate_image_tag_notspecified_deny.yaml
+  policy: samples/best_practices/require_image_tag_not_latest.yaml
-  resource: examples/best_practices/resources/resource_validate_image_tag_notspecified_pass.yaml
+  resource: examples/best_practices/resources/resource_validate_image_tag_latest_pass.yaml
 expected:
   validation:
     policyresponse:
-      policy: validate-image-tag-notspecified
+      policy: validate-image-tag
       resource:
         kind: Pod
         apiVersion: v1
@@ -16,3 +16,7 @@ expected:
           type: Validation
           message: "Validation rule 'image-tag-notspecified' succesfully validated"
           success: true    
+        - name: image-tag-not-latest
+          type: Validation
+          message: "Validation rule 'image-tag-not-latest' succesfully validated"
+          success: true  

test/scenarios/test/scenario_validate_image_tag_notspecified_deny.yaml

@@ -1,18 +0,0 @@
-# file path relative to project root
-input:
-  policy: examples/best_practices/policy_validate_image_tag_notspecified_deny.yaml
-  resource: examples/best_practices/resources/resource_validate_image_tag_notspecified_deny.yaml
-expected:
-  validation:
-    policyresponse:
-      policy: validate-image-tag-notspecified
-      resource:
-        kind: Pod
-        apiVersion: v1
-        namespace: ''
-        name: myapp-pod
-      rules:
-        - name: image-tag-notspecified
-          type: Validation
-          message: "Validation rule 'image-tag-notspecified' failed at '/spec/containers/0/image/' for resource Pod//myapp-pod. image tag not specified"
-          success: false