fix PSA chainsaw tests (#9389)

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

test/conformance/chainsaw/validate/clusterpolicy/standard/psa/test-exclusion-capabilities/bad-pod.yaml

@@ -24,13 +24,3 @@ spec:
       capabilities:
         add:
         - baz
-  ephemeralContainers:
-  - name: nginx3
-    image: nginx
-    args:
-    - sleep
-    - 1d
-    securityContext:
-      capabilities:
-        add:
-        - foo

test/conformance/chainsaw/validate/clusterpolicy/standard/psa/test-exclusion-hostprocesses/bad-pod.yaml

@@ -3,12 +3,13 @@ kind: Pod
 metadata:
   name: bad-pod
 spec:
+  hostNetwork: true
   securityContext:
     windowsOptions:
       hostProcess: true
   containers:
-  - name: nginx1
-    image: nginx
+  - name: busybox
+    image: busybox
     args:
     - sleep
     - 1d

test/conformance/chainsaw/validate/clusterpolicy/standard/psa/test-exclusion-privileged-containers/bad-pod.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-pod
+spec:
+  containers:
+  - name: busybox
+    image: busybox
+    args:
+    - sleep
+    - 1d
+    securityContext:
+      privileged: true
+  initContainers:
+  - name: nginx
+    image: nginx
+    args:
+    - sleep
+    - 1d
+    securityContext:
+      windowsOptions:
+        hostProcess: false

test/conformance/chainsaw/validate/clusterpolicy/standard/psa/test-exclusion-privileged-containers/chainsaw-test.yaml

@@ -13,6 +13,11 @@ spec:
         file: policy-assert.yaml
   - name: step-02
     try:
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: bad-pod.yaml
     - apply:
         file: excluded-pod.yaml
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/standard/psa/test-exclusion-restricted-seccomp/bad-pod.yaml

@@ -5,23 +5,23 @@ metadata:
 spec:
   securityContext:
     seccompProfile:
-      type: foo
+      type: Unconfined
   containers:
-  - name: nginx1
-    image: nginx
+  - name: busybox
+    image: busybox
     args:
     - sleep
     - 1d
     securityContext:
       seccompProfile:
-        type: baz
+        type: Unconfined
       runAsNonRoot: true
       allowPrivilegeEscalation: false
       capabilities:
         drop:
         - ALL
   initContainers:
-  - name: nginx2
+  - name: nginx
     image: nginx
     args:
     - sleep
@@ -29,6 +29,7 @@ spec:
     securityContext:
       seccompProfile:
         type: Localhost
+        localhostProfile: profiles/audit.json
       runAsNonRoot: true
       allowPrivilegeEscalation: false
       capabilities:

test/conformance/chainsaw/validate/clusterpolicy/standard/psa/test-exclusion-restricted-seccomp/excluded-pod.yaml

@@ -3,25 +3,8 @@ kind: Pod
 metadata:
   name: excluded-pod
 spec:
-  securityContext:
-    seccompProfile:
-      type: Unconfined
   containers:
-  - name: nginx1
-    image: nginx
-    args:
-    - sleep
-    - 1d
-    securityContext:
-      seccompProfile:
-        type: Unconfined
-      runAsNonRoot: true
-      allowPrivilegeEscalation: false
-      capabilities:
-        drop:
-        - ALL
-  initContainers:
-  - name: nginx2
+  - name: nginx
     image: nginx
     args:
     - sleep

test/conformance/chainsaw/validate/clusterpolicy/standard/psa/test-exclusion-restricted-seccomp/policy.yaml

@@ -17,19 +17,9 @@ spec:
         level: restricted
         version: latest
         exclude:
-        - controlName: "Seccomp"
-          restrictedField: "spec.securityContext.seccompProfile.type"
-          values:
-          - "Unconfined"
         - controlName: "Seccomp"
           images:
           - nginx
           restrictedField: "spec.containers[*].securityContext.seccompProfile.type"
           values:
           - "Unconfined"
-        - controlName: "Seccomp"
-          images:
-          - nginx
-          restrictedField: "spec.initContainers[*].securityContext.seccompProfile.type"
-          values:
-          - "Unconfined"

test/conformance/chainsaw/validate/clusterpolicy/standard/psa/test-exclusion-running-as-nonroot/bad-pod.yaml

@@ -4,21 +4,21 @@ metadata:
   name: bad-pod
 spec:
   containers:
-  - name: nginx1
-    image: nginx
+  - name: busybox
+    image: busybox
     args:
     - sleep
     - 1d
     securityContext:
       seccompProfile:
         type: RuntimeDefault
-      runAsNonRoot: true
+      runAsNonRoot: false
       allowPrivilegeEscalation: false
       capabilities:
         drop:
         - ALL
   initContainers:
-  - name: nginx2
+  - name: nginx
     image: nginx
     args:
     - sleep

test/conformance/chainsaw/validate/clusterpolicy/standard/psa/test-exclusion-seccomp/bad-pod.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   securityContext:
     seccompProfile:
-      type: foo
+      type: Unconfined
   containers:
   - name: nginx1
     image: nginx
@@ -14,7 +14,7 @@ spec:
     - 1d
     securityContext:
       seccompProfile:
-        type: baz
+        type: Unconfined
   initContainers:
   - name: nginx2
     image: nginx
@@ -23,4 +23,4 @@ spec:
     - 1d
     securityContext:
       seccompProfile:
-        type: Localhost
+        type: Unconfined

test/conformance/chainsaw/validate/clusterpolicy/standard/psa/test-exclusion-seccomp/excluded-pod.yaml

@@ -14,7 +14,7 @@ spec:
     - 1d
     securityContext:
       seccompProfile:
-        type: Unconfined
+        type: RuntimeDefault
   initContainers:
   - name: nginx2
     image: nginx
@@ -23,4 +23,4 @@ spec:
     - 1d
     securityContext:
       seccompProfile:
-        type: Unconfined
+        type: RuntimeDefault

test/conformance/chainsaw/validate/clusterpolicy/standard/psa/test-exclusion-seccomp/policy.yaml

@@ -21,15 +21,4 @@ spec:
           restrictedField: "spec.securityContext.seccompProfile.type"
           values:
           - "Unconfined"
-        - controlName: "Seccomp"
-          images:
-          - nginx
-          restrictedField: "spec.containers[*].securityContext.seccompProfile.type"
-          values:
-          - "Unconfined"
-        - controlName: "Seccomp"
-          images:
-          - nginx
-          restrictedField: "spec.initContainers[*].securityContext.seccompProfile.type"
-          values:
-          - "Unconfined"
+

test/conformance/chainsaw/validate/clusterpolicy/standard/psa/test-exclusion-volume-types/bad-pod.yaml

@@ -4,9 +4,10 @@ metadata:
   name: bad-pod
 spec:
   volumes:
-  - name: flex
-    flexVolume:
-      driver: /var/lib2
+  - name: udev
+    gcePersistentDisk:
+      pdName: gke-pv
+      fsType: ext4
   containers:
   - name: nginx
     image: nginx
@@ -16,6 +17,7 @@ spec:
     securityContext:
       seccompProfile:
         type: Localhost
+        localhostProfile: profiles/audit.json
       runAsNonRoot: true
       allowPrivilegeEscalation: false
       capabilities: