diff --git a/test/conformance/chainsaw/webhook-configurations/webhook-registeration/README.md b/test/conformance/chainsaw/webhook-configurations/webhook-registeration/README.md new file mode 100644 index 0000000000..ca7d0d578d --- /dev/null +++ b/test/conformance/chainsaw/webhook-configurations/webhook-registeration/README.md @@ -0,0 +1,11 @@ +## Description + +This test checks fine-grained webhook configuration is synced to admission webhooks. + +## Expected Behavior + +When a policy is created, a webhook rule is automatically created with the same `matchConditions` as configured in the policy. The corresponding webhook rule will be deleted when the policy is deleted. + +## Reference Issue(s) + +#9111 diff --git a/test/conformance/chainsaw/webhook-configurations/webhook-registeration/chainsaw-test.yaml b/test/conformance/chainsaw/webhook-configurations/webhook-registeration/chainsaw-test.yaml new file mode 100755 index 0000000000..4eec94825e --- /dev/null +++ b/test/conformance/chainsaw/webhook-configurations/webhook-registeration/chainsaw-test.yaml @@ -0,0 +1,28 @@ +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + creationTimestamp: null + name: webhook-registeration +spec: + steps: + - name: step-01 + try: + - apply: + file: policy.yaml + - assert: + file: policy-assert.yaml + - name: step-02 + try: + - assert: + file: webhook.yaml + - name: step-03 + try: + - delete: + ref: + apiVersion: kyverno.io/v1 + kind: ClusterPolicy + name: cpol-fine-grained-match-conditions-disallow-latest-image-tag-1 + - name: step-04 + try: + - error: + file: webhook.yaml diff --git a/test/conformance/chainsaw/webhook-configurations/webhook-registeration/policy-assert.yaml b/test/conformance/chainsaw/webhook-configurations/webhook-registeration/policy-assert.yaml new file mode 100644 index 0000000000..3e6f6d6c70 --- /dev/null +++ b/test/conformance/chainsaw/webhook-configurations/webhook-registeration/policy-assert.yaml @@ -0,0 +1,9 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: cpol-fine-grained-match-conditions-disallow-latest-image-tag-1 +status: + conditions: + - reason: Succeeded + status: "True" + type: Ready diff --git a/test/conformance/chainsaw/webhook-configurations/webhook-registeration/policy.yaml b/test/conformance/chainsaw/webhook-configurations/webhook-registeration/policy.yaml new file mode 100644 index 0000000000..8404cb2216 --- /dev/null +++ b/test/conformance/chainsaw/webhook-configurations/webhook-registeration/policy.yaml @@ -0,0 +1,41 @@ +--- +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + annotations: + pod-policies.kyverno.io/autogen-controllers: none + name: cpol-fine-grained-match-conditions-disallow-latest-image-tag-1 +spec: + admission: true + background: true + webhookConfiguration: + matchConditions: + - name: 'exclude-requests-by-groups' + expression: '!("system:nodes" in request.userInfo.groups)' + rules: + - match: + any: + - resources: + kinds: + - Pod + name: require-image-tag + validate: + message: An image tag is required + pattern: + spec: + containers: + - image: '*:*' + - match: + any: + - resources: + kinds: + - Pod + name: validate-image-tag + validate: + message: Using a mutable image tag e.g. 'latest' is not allowed + pattern: + spec: + containers: + - image: '!*:latest' + validationFailureAction: Enforce + failurePolicy: Ignore \ No newline at end of file diff --git a/test/conformance/chainsaw/webhook-configurations/webhook-registeration/webhook.yaml b/test/conformance/chainsaw/webhook-configurations/webhook-registeration/webhook.yaml new file mode 100644 index 0000000000..2924b1115c --- /dev/null +++ b/test/conformance/chainsaw/webhook-configurations/webhook-registeration/webhook.yaml @@ -0,0 +1,27 @@ +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + labels: + webhook.kyverno.io/managed-by: kyverno + name: kyverno-resource-validating-webhook-cfg +webhooks: +- failurePolicy: Ignore + matchConditions: + - expression: '!("system:nodes" in request.userInfo.groups)' + name: exclude-requests-by-groups + matchPolicy: Equivalent + name: validate.kyverno.svc-ignore-finegrained-cpol-fine-grained-match-conditions-disallow-latest-image-tag-1 + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + - DELETE + - CONNECT + resources: + - pods + - pods/ephemeralcontainers + scope: Namespaced