1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-01-20 18:52:16 +00:00

chore: use more chainsaw step templates (#11300)

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
Charles-Edouard Brétéché 2024-10-03 10:36:30 +02:00 committed by GitHub
parent 00eeb644d9
commit 6870d8fdf8
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
67 changed files with 396 additions and 426 deletions

View file

@ -6,11 +6,21 @@ spec:
concurrent: false concurrent: false
namespace: foo namespace: foo
steps: steps:
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: basic-sigstore-test-policy
- try: - try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- script: - script:
content: kubectl run -n $NAMESPACE test-sigstore --image=$TEST_IMAGE_URL content: kubectl run -n $NAMESPACE test-sigstore --image=$TEST_IMAGE_URL
- assert: - assert:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: basic-sigstore-test-policy
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -6,11 +6,21 @@ spec:
concurrent: false concurrent: false
namespace: foo namespace: foo
steps: steps:
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: basic-sigstore-test-policy
- try: - try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- script: - script:
content: kubectl run -n $NAMESPACE test-sigstore --image=$TEST_IMAGE_URL content: kubectl run -n $NAMESPACE test-sigstore --image=$TEST_IMAGE_URL
- assert: - assert:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: basic-sigstore-test-policy
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,24 @@ metadata:
name: dependencies name: dependencies
spec: spec:
steps: steps:
- name: step-01 - name: create namespace
try: try:
- apply: - apply:
file: manifests.yaml file: ns.yaml
- assert: - name: create policy
file: policy-assert.yaml use:
template: ../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: enforce-company-budget
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,5 +1,3 @@
---
apiVersion: apps/v1 apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:

View file

@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: acme-fitness

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: enforce-company-budget
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -1,9 +1,3 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: acme-fitness
---
apiVersion: kyverno.io/v1 apiVersion: kyverno.io/v1
kind: ClusterPolicy kind: ClusterPolicy
metadata: metadata:

View file

@ -4,12 +4,24 @@ metadata:
name: dependencies name: dependencies
spec: spec:
steps: steps:
- name: step-01 - name: create namespace
try: try:
- apply: - apply:
file: manifests.yaml file: ns.yaml
- assert: - name: create policy
file: policy-assert.yaml use:
template: ../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: enforce-company-budget
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,5 +1,3 @@
---
apiVersion: apps/v1 apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:

View file

@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: acme-fitness

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: enforce-company-budget
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -1,9 +1,3 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: acme-fitness
---
apiVersion: kyverno.io/v1 apiVersion: kyverno.io/v1
kind: ClusterPolicy kind: ClusterPolicy
metadata: metadata:

View file

@ -4,12 +4,20 @@ metadata:
name: foreach name: foreach
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: manifests.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: testcase-7fki3
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: testcase-7fki3
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -1,4 +1,3 @@
---
apiVersion: kyverno.io/v1 apiVersion: kyverno.io/v1
kind: ClusterPolicy kind: ClusterPolicy
metadata: metadata:

View file

@ -4,12 +4,20 @@ metadata:
name: recursive name: recursive
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: one
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: one
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: resolve-overriden-variable name: resolve-overriden-variable
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: one
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: one
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: two-rules name: two-rules
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: one
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: one
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: no-wildcard name: no-wildcard
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: block-pod
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: block-pod
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: wildcard name: wildcard
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: block-pod
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: block-pod
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: block name: block
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: block-pod
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: block-pod
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: pass name: pass
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: block-pod
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: block-pod
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: block name: block
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: block-pod
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: block-pod
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: pass name: pass
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: block-pod
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: block-pod
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: no-wildcard name: no-wildcard
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: block-pod
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: block-pod
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: wildcard name: wildcard
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: block-pod
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: block-pod
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: block name: block
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: block-pod
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: block-pod
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: pass name: pass
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: block-pod
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: block-pod
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: block name: block
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: block-pod
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: block-pod
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: pass name: pass
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: block-pod
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: block-pod
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,8 +4,7 @@ metadata:
name: apicall-correct name: apicall-correct
spec: spec:
steps: steps:
- name: scenario - try:
try:
- apply: - apply:
file: namespace.yaml file: namespace.yaml
- apply: - apply:
@ -14,12 +13,23 @@ spec:
file: gctxentry.yaml file: gctxentry.yaml
- sleep: - sleep:
duration: 3s duration: 3s
- apply: - name: create policy
file: clusterpolicy.yaml use:
template: ../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: cpol-apicall-correct
- try:
- sleep: - sleep:
duration: 3s duration: 3s
- assert:
file: clusterpolicy-ready.yaml
- apply: - apply:
file: new-deployment.yaml file: new-deployment.yaml
- assert: - assert:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: cpol-apicall-correct
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -14,12 +14,21 @@ spec:
file: gctxentry.yaml file: gctxentry.yaml
- sleep: - sleep:
duration: 3s duration: 3s
- apply: - name: create policy
file: clusterpolicy.yaml use:
- sleep: template: ../../_step-templates/create-policy.yaml
duration: 3s with:
- assert: bindings:
file: clusterpolicy-ready.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: cpol-not-ready
- try:
- delete: - delete:
ref: ref:
apiVersion: kyverno.io/v2alpha1 apiVersion: kyverno.io/v2alpha1
@ -28,7 +37,7 @@ spec:
- sleep: - sleep:
duration: 3s duration: 3s
- assert: - assert:
file: clusterpolicy-failed.yaml file: policy-failed.yaml
- apply: - apply:
file: new-deployment.yaml file: new-deployment.yaml
- assert: - assert:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: cpol-not-ready
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -1,7 +1,7 @@
apiVersion: chainsaw.kyverno.io/v1alpha1 apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test kind: Test
metadata: metadata:
name: resource-correct name: cpol-resource-correct
spec: spec:
steps: steps:
- name: scenario - name: scenario
@ -14,12 +14,21 @@ spec:
file: gctxentry.yaml file: gctxentry.yaml
- sleep: - sleep:
duration: 3s duration: 3s
- apply: - name: create policy
file: clusterpolicy.yaml use:
- sleep: template: ../../_step-templates/create-policy.yaml
duration: 3s with:
- assert: bindings:
file: clusterpolicy-ready.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: cpol-resource-correct
- try:
- apply: - apply:
file: new-deployment.yaml file: new-deployment.yaml
- assert: - assert:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: cpol-resource-correct
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: background-variables-update name: background-variables-update
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: background-variables-update
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: background-variables-update
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: policy-exceptions-disabled name: policy-exceptions-disabled
spec: spec:
steps: steps:
- name: step-00 - name: create policy
try: use:
- apply: template: ../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: require-app-label
- name: step-01 - name: step-01
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-app-label
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,7 +4,17 @@ metadata:
name: schema-validation-crd name: schema-validation-crd
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../_step-templates/create-policy.yaml
file: chainsaw-step-01-apply-1.yaml with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: mutate-xteam-namespace-scoped-crds

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: mutate-xteam-namespace-scoped-crds
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,9 +4,17 @@ metadata:
name: success name: success
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../_step-templates/create-policy.yaml
file: policy-1.yaml with:
- assert: bindings:
file: policy-1-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: vault-init-injector

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: vault-init-injector
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready