diff --git a/.github/workflows/conformance.yaml b/.github/workflows/conformance.yaml index 000cac3509..f74ec8bf7d 100644 --- a/.github/workflows/conformance.yaml +++ b/.github/workflows/conformance.yaml @@ -178,7 +178,6 @@ jobs: version: v1.28.0 tests: # - autogen - # - background-only # - cleanup # - deferred # - events @@ -190,13 +189,13 @@ jobs: # - mutate # - policy-validation # - rangeoperators - # - rbac # - reports # - validate # - verify-manifests # - verifyImages - webhooks - background-only + - rbac needs: prepare-images name: chainsaw - ${{ matrix.k8s-version.name }} - ${{ matrix.config.name }} - ${{ matrix.tests }} steps: diff --git a/test/conformance/chainsaw/rbac/aggregate-to-admin/00-cluster-role.yaml b/test/conformance/chainsaw/rbac/aggregate-to-admin/00-cluster-role.yaml new file mode 100644 index 0000000000..6e92136478 --- /dev/null +++ b/test/conformance/chainsaw/rbac/aggregate-to-admin/00-cluster-role.yaml @@ -0,0 +1,14 @@ +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: TestStep +metadata: + name: rbac +spec: + try: + - assert: + file: admin-policies.yaml + - assert: + file: admin-policyreport.yaml + - assert: + file: admin-reports.yaml + - assert: + file: admin-updaterequest.yaml diff --git a/test/conformance/chainsaw/rbac/aggregate-to-admin/README.md b/test/conformance/chainsaw/rbac/aggregate-to-admin/README.md new file mode 100644 index 0000000000..7d5c9c76dc --- /dev/null +++ b/test/conformance/chainsaw/rbac/aggregate-to-admin/README.md @@ -0,0 +1,3 @@ +## Description + +This test verifies that kyverno admin cluster roles exist in the cluster and are labelled correctly to be aggregated to the `admin` cluster role. diff --git a/test/conformance/chainsaw/rbac/aggregate-to-admin/admin-policies.yaml b/test/conformance/chainsaw/rbac/aggregate-to-admin/admin-policies.yaml new file mode 100644 index 0000000000..d79fa25da0 --- /dev/null +++ b/test/conformance/chainsaw/rbac/aggregate-to-admin/admin-policies.yaml @@ -0,0 +1,22 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: kyverno:rbac:admin:policies + labels: + rbac.authorization.k8s.io/aggregate-to-admin: "true" +rules: + - apiGroups: + - kyverno.io + resources: + - cleanuppolicies + - clustercleanuppolicies + - policies + - clusterpolicies + verbs: + - create + - delete + - get + - list + - patch + - update + - watch diff --git a/test/conformance/chainsaw/rbac/aggregate-to-admin/admin-policyreport.yaml b/test/conformance/chainsaw/rbac/aggregate-to-admin/admin-policyreport.yaml new file mode 100644 index 0000000000..18e5e3088a --- /dev/null +++ b/test/conformance/chainsaw/rbac/aggregate-to-admin/admin-policyreport.yaml @@ -0,0 +1,20 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: kyverno:rbac:admin:policyreports + labels: + rbac.authorization.k8s.io/aggregate-to-admin: "true" +rules: + - apiGroups: + - wgpolicyk8s.io + resources: + - policyreports + - clusterpolicyreports + verbs: + - create + - delete + - get + - list + - patch + - update + - watch diff --git a/test/conformance/chainsaw/rbac/aggregate-to-admin/admin-reports.yaml b/test/conformance/chainsaw/rbac/aggregate-to-admin/admin-reports.yaml new file mode 100644 index 0000000000..4182aad28c --- /dev/null +++ b/test/conformance/chainsaw/rbac/aggregate-to-admin/admin-reports.yaml @@ -0,0 +1,22 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: kyverno:rbac:admin:reports + labels: + rbac.authorization.k8s.io/aggregate-to-admin: "true" +rules: + - apiGroups: + - kyverno.io + resources: + - admissionreports + - clusteradmissionreports + - backgroundscanreports + - clusterbackgroundscanreports + verbs: + - create + - delete + - get + - list + - patch + - update + - watch diff --git a/test/conformance/chainsaw/rbac/aggregate-to-admin/admin-updaterequest.yaml b/test/conformance/chainsaw/rbac/aggregate-to-admin/admin-updaterequest.yaml new file mode 100644 index 0000000000..b079083c85 --- /dev/null +++ b/test/conformance/chainsaw/rbac/aggregate-to-admin/admin-updaterequest.yaml @@ -0,0 +1,19 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: kyverno:rbac:admin:updaterequests + labels: + rbac.authorization.k8s.io/aggregate-to-admin: "true" +rules: + - apiGroups: + - kyverno.io + resources: + - updaterequests + verbs: + - create + - delete + - get + - list + - patch + - update + - watch