mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-28 02:18:15 +00:00
Code Activity

feat: add chainsaw tests for pod security in exceptions (#9667)

Browse source 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
This commit is contained in:
Mariam Fahmy 2024-02-06 15:07:58 +02:00 • committed by GitHub
parent ba01f95266
commit ace5b59003
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
117 changed files with 2594 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
test/conformance/chainsaw/exceptions/exclude-hostpath-volume/README.md Normal file
View file

@ -0,0 +1,12 @@
## Description
This test creates a policy that enforces the baseline profile and a policy exception that exempts any pod whose namespace is `staging-ns` and make use of the HostPath volume.
## Steps
1. - Create a cluster policy
- Assert the policy becomes ready
1. - Create a policy exception for the cluster policy created above.
1. - Try to create a pod named `good-pod-1` in the `default` namespace and doesn't use the HostPath volume, expecting the creation to succeed.
- Try to create a pod named `good-pod-2` in the `staging-ns` namespace that uses the HostPath volume, expecting the creation to succeed.
- Try to create a pod named `bad-pod` in the `default` namespace that makes use of the HostPath volume, expecting the creation to fail.

35
test/conformance/chainsaw/exceptions/exclude-hostpath-volume/chainsaw-test.yaml Executable file
View file

@ -0,0 +1,35 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
creationTimestamp: null
name: exclude-hostpath-volume
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: step-02
try:
- apply:
file: ns.yaml
- assert:
file: ns.yaml
- name: step-03
try:
- apply:
file: exception.yaml
- name: step-04
try:
- apply:
file: pod-allowed-1.yaml
- apply:
file: pod-allowed-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected.yaml

20
test/conformance/chainsaw/exceptions/exclude-hostpath-volume/exception.yaml Normal file
View file

@ -0,0 +1,20 @@
apiVersion: kyverno.io/v2beta1
kind: PolicyException
metadata:
name: pod-security-exception
namespace: policy-exception-ns
spec:
exceptions:
- policyName: psa
ruleNames:
- baseline
match:
any:
- resources:
namespaces:
- staging-ns
podSecurity:
- controlName: "HostPath Volumes"
restrictedField: "spec.volumes[*].hostPath"
values:
- "path"

9
test/conformance/chainsaw/exceptions/exclude-hostpath-volume/ns.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: v1
kind: Namespace
metadata:
name: policy-exception-ns
---
apiVersion: v1
kind: Namespace
metadata:
name: staging-ns

12
test/conformance/chainsaw/exceptions/exclude-hostpath-volume/pod-allowed-1.yaml Normal file
View file

@ -0,0 +1,12 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-1
namespace: default
spec:
containers:
- name: nginx
image: nginx
args:
- sleep
- 1d

16
test/conformance/chainsaw/exceptions/exclude-hostpath-volume/pod-allowed-2.yaml Normal file
View file

@ -0,0 +1,16 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-2
namespace: staging-ns
spec:
volumes:
- name: host
hostPath:
path: /var/lib1
containers:
- name: nginx
image: nginx
args:
- sleep
- 1d

16
test/conformance/chainsaw/exceptions/exclude-hostpath-volume/pod-rejected.yaml Normal file
View file

@ -0,0 +1,16 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod
namespace: default
spec:
volumes:
- name: host
hostPath:
path: /var/lib1
containers:
- name: nginx
image: nginx
args:
- sleep
- 1d

9
test/conformance/chainsaw/exceptions/exclude-hostpath-volume/policy-assert.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

18
test/conformance/chainsaw/exceptions/exclude-hostpath-volume/policy.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
spec:
background: true
validationFailureAction: Enforce
rules:
- name: baseline
match:
any:
- resources:
kinds:
- Pod
validate:
podSecurity:
level: baseline
version: latest

13
test/conformance/chainsaw/exceptions/exclude-privilege-escalation/README.md Normal file
View file

@ -0,0 +1,13 @@
## Description
This test creates a policy that enforces the restricted profile and a policy exception that exempts any pod whose image is `nginx` in the `staging-ns` namespace and sets the `allowPrivilegeEscalation` field.
## Steps
1. - Create a cluster policy
- Assert the policy becomes ready
1. - Create a policy exception for the cluster policy created above.
1. - Try to create a pod named `good-pod-1` with `allowPrivilegeEscalation` set to `false` in the `default` namespace, expecting the creation to succeed.
- Try to create a pod named `good-pod-2` whose image is `nginx` in the `staging-ns` namespace and the `allowPrivilegeEscalation` is set to `true`, expecting the creation to succeed.
- Try to create a pod named `bad-pod-1` whose image is `busybox` in the `staging-ns` namespace and the `allowPrivilegeEscalation` is set to `true`, expecting the creation to fail.
- Try to create a pod named `bad-pod-2` whose image is `nginx` in the `default` namespace and the `allowPrivilegeEscalation` is set to `true`, expecting the creation to fail.

39
test/conformance/chainsaw/exceptions/exclude-privilege-escalation/chainsaw-test.yaml Executable file
View file

@ -0,0 +1,39 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
creationTimestamp: null
name: exclude-privilege-escalation
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: step-02
try:
- apply:
file: ns.yaml
- assert:
file: ns.yaml
- name: step-03
try:
- apply:
file: exception.yaml
- name: step-04
try:
- apply:
file: pod-allowed-1.yaml
- apply:
file: pod-allowed-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-1.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-2.yaml

28
test/conformance/chainsaw/exceptions/exclude-privilege-escalation/exception.yaml Normal file
View file

@ -0,0 +1,28 @@
apiVersion: kyverno.io/v2beta1
kind: PolicyException
metadata:
name: pod-security-exception
namespace: policy-exception-ns
spec:
exceptions:
- policyName: psa
ruleNames:
- restricted
match:
any:
- resources:
namespaces:
- staging-ns
podSecurity:
- controlName: "Privilege Escalation"
images:
- nginx
restrictedField: "spec.containers[*].securityContext.allowPrivilegeEscalation"
values:
- "true"
- controlName: "Privilege Escalation"
images:
- nginx
restrictedField: "spec.initContainers[*].securityContext.allowPrivilegeEscalation"
values:
- "true"

9
test/conformance/chainsaw/exceptions/exclude-privilege-escalation/ns.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: v1
kind: Namespace
metadata:
name: policy-exception-ns
---
apiVersion: v1
kind: Namespace
metadata:
name: staging-ns

34
test/conformance/chainsaw/exceptions/exclude-privilege-escalation/pod-allowed-1.yaml Normal file
View file

@ -0,0 +1,34 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-1
namespace: default
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

34
test/conformance/chainsaw/exceptions/exclude-privilege-escalation/pod-allowed-2.yaml Normal file
View file

@ -0,0 +1,34 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-2
namespace: staging-ns
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: true
capabilities:
drop:
- ALL
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: true
capabilities:
drop:
- ALL

34
test/conformance/chainsaw/exceptions/exclude-privilege-escalation/pod-rejected-1.yaml Normal file
View file

@ -0,0 +1,34 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-1
namespace: staging-ns
spec:
containers:
- name: busybox1
image: busybox
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: true
capabilities:
drop:
- ALL
initContainers:
- name: busybox2
image: busybox
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: true
capabilities:
drop:
- ALL

34
test/conformance/chainsaw/exceptions/exclude-privilege-escalation/pod-rejected-2.yaml Normal file
View file

@ -0,0 +1,34 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-2
namespace: default
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: true
capabilities:
drop:
- ALL
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: true
capabilities:
drop:
- ALL

9
test/conformance/chainsaw/exceptions/exclude-privilege-escalation/policy-assert.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

18
test/conformance/chainsaw/exceptions/exclude-privilege-escalation/policy.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
spec:
background: true
validationFailureAction: Enforce
rules:
- name: restricted
match:
any:
- resources:
kinds:
- Pod
validate:
podSecurity:
level: restricted
version: latest

14
test/conformance/chainsaw/exceptions/exclude-privileged-containers/README.md Normal file
View file

@ -0,0 +1,14 @@
## Description
This test creates a policy that enforces the baseline profile and a policy exception that exempts any pod whose image is `nginx` in the `staging-ns` namespace and sets the `securityContext.privileged` field in containers and initContainers only.
## Steps
1. - Create a cluster policy
- Assert the policy becomes ready
1. - Create a policy exception for the cluster policy created above.
1. - Try to create a pod named `good-pod-1` with `securityContext.privileged` set to `false` in the `default` namespace, expecting the creation to succeed.
- Try to create a pod named `good-pod-2` whose image is `nginx` in the `staging-ns` namespace and the `securityContext.privileged` is set to `true` in containers and initContainers, expecting the creation to succeed.
- Try to create a pod named `bad-pod-1` whose image is `nginx` in the `staging-ns` namespace and the `securityContext.privileged` is set to `true` in containers, initContainers and ephemeralContainers, expecting the creation to fail.
- Try to create a pod named `bad-pod-2` whose image is `busybox` in the `staging-ns` namespace and the `securityContext.privileged` is set to `true` in containers and initContainers, expecting the creation to fail.
- Try to create a pod named `bad-pod-3` whose image is `nginx` in the `default` namespace and the `securityContext.privileged` is set to `true`, expecting the creation to fail.

44
test/conformance/chainsaw/exceptions/exclude-privileged-containers/chainsaw-test.yaml Executable file
View file

@ -0,0 +1,44 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
creationTimestamp: null
name: exclude-privileged-containers
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: step-02
try:
- apply:
file: ns.yaml
- assert:
file: ns.yaml
- name: step-03
try:
- apply:
file: exception.yaml
- name: step-04
try:
- apply:
file: pod-allowed-1.yaml
- apply:
file: pod-allowed-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-1.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-3.yaml

28
test/conformance/chainsaw/exceptions/exclude-privileged-containers/exception.yaml Normal file
View file

@ -0,0 +1,28 @@
apiVersion: kyverno.io/v2beta1
kind: PolicyException
metadata:
name: pod-security-exception
namespace: policy-exception-ns
spec:
exceptions:
- policyName: psa
ruleNames:
- baseline
match:
any:
- resources:
namespaces:
- staging-ns
podSecurity:
- controlName: "Privileged Containers"
images:
- nginx
restrictedField: "spec.containers[*].securityContext.privileged"
values:
- "true"
- controlName: "Privileged Containers"
images:
- nginx
restrictedField: "spec.initContainers[*].securityContext.privileged"
values:
- "true"

9
test/conformance/chainsaw/exceptions/exclude-privileged-containers/ns.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: v1
kind: Namespace
metadata:
name: policy-exception-ns
---
apiVersion: v1
kind: Namespace
metadata:
name: staging-ns

14
test/conformance/chainsaw/exceptions/exclude-privileged-containers/pod-allowed-1.yaml Normal file
View file

@ -0,0 +1,14 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-1
namespace: default
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- "3000"
securityContext:
privileged: false

22
test/conformance/chainsaw/exceptions/exclude-privileged-containers/pod-allowed-2.yaml Normal file
View file

@ -0,0 +1,22 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-2
namespace: staging-ns
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- "3000"
securityContext:
privileged: true
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- "3000"
securityContext:
privileged: true

30
test/conformance/chainsaw/exceptions/exclude-privileged-containers/pod-rejected-1.yaml Normal file
View file

@ -0,0 +1,30 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-1
namespace: staging-ns
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
privileged: true
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
privileged: true
ephemeralContainers:
- name: nginx3
image: nginx
args:
- sleep
- 1d
securityContext:
privileged: true

22
test/conformance/chainsaw/exceptions/exclude-privileged-containers/pod-rejected-2.yaml Normal file
View file

@ -0,0 +1,22 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-2
namespace: staging-ns
spec:
containers:
- name: busybox1
image: busybox
args:
- sleep
- 1d
securityContext:
privileged: true
initContainers:
- name: busybox2
image: busybox
args:
- sleep
- 1d
securityContext:
privileged: true

23
test/conformance/chainsaw/exceptions/exclude-privileged-containers/pod-rejected-3.yaml Normal file
View file

@ -0,0 +1,23 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-3
namespace: default
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
privileged: true
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
windowsOptions:
hostProcess: true

9
test/conformance/chainsaw/exceptions/exclude-privileged-containers/policy-assert.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

18
test/conformance/chainsaw/exceptions/exclude-privileged-containers/policy.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
spec:
background: true
validationFailureAction: Enforce
rules:
- name: baseline
match:
any:
- resources:
kinds:
- Pod
validate:
podSecurity:
level: baseline
version: latest

17
test/conformance/chainsaw/exceptions/exclude-restricted-capabilities/README.md Normal file
View file

@ -0,0 +1,17 @@
## Description
This test creates a policy that enforces the restricted profile and a policy exception that exempts any pod whose image is `nginx` in the `staging-ns` namespace and fields:
1. `spec.containers[*].securityContext.capabilities.add` is set to `foo`.
2. `spec.initContainers[*].securityContext.capabilities.add` is set to `baz`.
## Steps
1. - Create a cluster policy
- Assert the policy becomes ready
1. - Create a policy exception for the cluster policy created above.
1. - Try to create a pod named `good-pod-1` in the `default` namespace with `spec.containers[*].securityContext.capabilities.add` set to `NET_BIND_SERVICE`, expecting the creation to succeed.
- Try to create a pod named `good-pod-2` whose image is `nginx` in the `staging-ns` namespace with `spec.containers[*].securityContext.capabilities.add` set to `foo` and `spec.initContainers[*].securityContext.capabilities.add` set to `baz`, expecting the creation to succeed.
- Try to create a pod named `bad-pod-1` whose image is `nginx` in the `staging-ns` namespace with `spec.containers[*].securityContext.capabilities.add` set to `baz` and `spec.initContainers[*].securityContext.capabilities.add` set to `foo`, expecting the creation to fail.
- Try to create a pod named `bad-pod-2` whose image is `busybox` in the `staging-ns` namespace with `spec.containers[*].securityContext.capabilities.add` set to `foo` and `spec.initContainers[*].securityContext.capabilities.add` set to `baz`, expecting the creation to fail.
- Try to create a pod named `bad-pod-3` whose image is `nginx` in the `staging-ns` namespace with `spec.containers[*].securityContext.capabilities.add` set to `foo` and `spec.ephemeralContainers[*].securityContext.capabilities.add` set to `baz`, expecting the creation to fail.
- Try to create a pod named `bad-pod-4` whose image is `nginx` in the `default` namespace with `spec.containers[*].securityContext.capabilities.add` set to `foo` and `spec.initContainers[*].securityContext.capabilities.add` set to `baz`, expecting the creation to fail.

49
test/conformance/chainsaw/exceptions/exclude-restricted-capabilities/chainsaw-test.yaml Executable file
View file

@ -0,0 +1,49 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
creationTimestamp: null
name: exclude-restricted-capabilities
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: step-02
try:
- apply:
file: ns.yaml
- assert:
file: ns.yaml
- name: step-03
try:
- apply:
file: exception.yaml
- name: step-04
try:
- apply:
file: pod-allowed-1.yaml
- apply:
file: pod-allowed-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-1.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-3.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-4.yaml

29
test/conformance/chainsaw/exceptions/exclude-restricted-capabilities/exception.yaml Normal file
View file

@ -0,0 +1,29 @@
apiVersion: kyverno.io/v2beta1
kind: PolicyException
metadata:
name: pod-security-exception
namespace: policy-exception-ns
spec:
exceptions:
- policyName: psa
ruleNames:
- restricted
match:
any:
- resources:
namespaces:
- staging-ns
podSecurity:
- controlName: "Capabilities"
images:
- nginx
restrictedField: "spec.containers[*].securityContext.capabilities.add"
values:
- "foo"
- controlName: "Capabilities"
images:
- nginx
restrictedField: "spec.initContainers[*].securityContext.capabilities.add"
values:
- "baz"

9
test/conformance/chainsaw/exceptions/exclude-restricted-capabilities/ns.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: v1
kind: Namespace
metadata:
name: policy-exception-ns
---
apiVersion: v1
kind: Namespace
metadata:
name: staging-ns

36
test/conformance/chainsaw/exceptions/exclude-restricted-capabilities/pod-allowed-1.yaml Normal file
View file

@ -0,0 +1,36 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-1
namespace: default
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

38
test/conformance/chainsaw/exceptions/exclude-restricted-capabilities/pod-allowed-2.yaml Normal file
View file

@ -0,0 +1,38 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-2
namespace: staging-ns
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
add:
- foo
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
add:
- baz

38
test/conformance/chainsaw/exceptions/exclude-restricted-capabilities/pod-rejected-1.yaml Normal file
View file

@ -0,0 +1,38 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-1
namespace: staging-ns
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
add:
- baz
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
add:
- foo

38
test/conformance/chainsaw/exceptions/exclude-restricted-capabilities/pod-rejected-2.yaml Normal file
View file

@ -0,0 +1,38 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-2
namespace: staging-ns
spec:
containers:
- name: busybox1
image: busybox
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
add:
- foo
initContainers:
- name: busybox2
image: busybox
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
add:
- baz

38
test/conformance/chainsaw/exceptions/exclude-restricted-capabilities/pod-rejected-3.yaml Normal file
View file

@ -0,0 +1,38 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-3
namespace: staging-ns
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
add:
- foo
ephemeralContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
add:
- baz

36
test/conformance/chainsaw/exceptions/exclude-restricted-capabilities/pod-rejected-4.yaml Normal file
View file

@ -0,0 +1,36 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-4
namespace: default
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
add:
- foo
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

9
test/conformance/chainsaw/exceptions/exclude-restricted-capabilities/policy-assert.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

18
test/conformance/chainsaw/exceptions/exclude-restricted-capabilities/policy.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
spec:
background: true
validationFailureAction: Enforce
rules:
- name: restricted
match:
any:
- resources:
kinds:
- Pod
validate:
podSecurity:
level: restricted
version: latest

14
test/conformance/chainsaw/exceptions/exclude-restricted-seccomp/README.md Normal file
View file

@ -0,0 +1,14 @@
## Description
This test creates a policy that enforces the restricted profile and a policy exception that exempts any pod whose image is `nginx` in the `staging-ns` namespace and sets the `spec.containers[*].securityContext.seccompProfile.type` to `Unconfined`.
## Steps
1. - Create a cluster policy
- Assert the policy becomes ready
1. - Create a policy exception for the cluster policy created above.
1. - Try to create a pod named `good-pod-1` in the `default` namespace that doesn't violate the restricted profile, expecting the creation to succeed.
- Try to create a pod named `good-pod-2` whose image is `nginx` in the `staging-ns` namespace and the `spec.containers[*].securityContext.seccompProfile.type` is set to `Unconfined`, expecting the creation to succeed.
- Try to create a pod named `bad-pod-1` whose image is `busybox` in the `staging-ns` namespace and the `spec.containers[*].securityContext.seccompProfile.type` is set to `Unconfined`, expecting the creation to fail.
- Try to create a pod named `bad-pod-2` whose image is `nginx` in the `staging-ns` namespace and the `spec.initContainers[*].securityContext.seccompProfile.type` is set to `Unconfined`, expecting the creation to fail.
- Try to create a pod named `bad-pod-3` whose image is `nginx` in the `default` namespace and the `spec.containers[*].securityContext.seccompProfile.type` is set to `Unconfined`, expecting the creation to fail.

44
test/conformance/chainsaw/exceptions/exclude-restricted-seccomp/chainsaw-test.yaml Executable file
View file

@ -0,0 +1,44 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
creationTimestamp: null
name: exclude-restricted-seccomp
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: step-02
try:
- apply:
file: ns.yaml
- assert:
file: ns.yaml
- name: step-03
try:
- apply:
file: exception.yaml
- name: step-04
try:
- apply:
file: pod-allowed-1.yaml
- apply:
file: pod-allowed-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-1.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-3.yaml

22
test/conformance/chainsaw/exceptions/exclude-restricted-seccomp/exception.yaml Normal file
View file

@ -0,0 +1,22 @@
apiVersion: kyverno.io/v2beta1
kind: PolicyException
metadata:
name: pod-security-exception
namespace: policy-exception-ns
spec:
exceptions:
- policyName: psa
ruleNames:
- restricted
match:
any:
- resources:
namespaces:
- staging-ns
podSecurity:
- controlName: "Seccomp"
images:
- nginx
restrictedField: "spec.containers[*].securityContext.seccompProfile.type"
values:
- "Unconfined"

9
test/conformance/chainsaw/exceptions/exclude-restricted-seccomp/ns.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: v1
kind: Namespace
metadata:
name: policy-exception-ns
---
apiVersion: v1
kind: Namespace
metadata:
name: staging-ns

37
test/conformance/chainsaw/exceptions/exclude-restricted-seccomp/pod-allowed-1.yaml Normal file
View file

@ -0,0 +1,37 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-1
namespace: default
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

20
test/conformance/chainsaw/exceptions/exclude-restricted-seccomp/pod-allowed-2.yaml Normal file
View file

@ -0,0 +1,20 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-2
namespace: staging-ns
spec:
containers:
- name: nginx
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: Unconfined
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

20
test/conformance/chainsaw/exceptions/exclude-restricted-seccomp/pod-rejected-1.yaml Normal file
View file

@ -0,0 +1,20 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-1
namespace: staging-ns
spec:
containers:
- name: busybox
image: busybox
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: Unconfined
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

34
test/conformance/chainsaw/exceptions/exclude-restricted-seccomp/pod-rejected-2.yaml Normal file
View file

@ -0,0 +1,34 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-2
namespace: staging-ns
spec:
containers:
- name: nginx
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: Unconfined
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
initContainers:
- name: nginx
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: Unconfined
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

20
test/conformance/chainsaw/exceptions/exclude-restricted-seccomp/pod-rejected-3.yaml Normal file
View file

@ -0,0 +1,20 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-3
namespace: default
spec:
containers:
- name: nginx
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: Unconfined
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

9
test/conformance/chainsaw/exceptions/exclude-restricted-seccomp/policy-assert.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

18
test/conformance/chainsaw/exceptions/exclude-restricted-seccomp/policy.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
spec:
background: true
validationFailureAction: Enforce
rules:
- name: restricted
match:
any:
- resources:
kinds:
- Pod
validate:
podSecurity:
level: restricted
version: latest

14
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot-user/README.md Normal file
View file

@ -0,0 +1,14 @@
## Description
This test creates a policy that enforces the restricted profile and a policy exception that exempts any pod whose image is `nginx` in the `staging-ns` namespace and sets the `spec.containers[*].securityContext.runAsUser` field to 0.
## Steps
1. - Create a cluster policy
- Assert the policy becomes ready
1. - Create a policy exception for the cluster policy created above.
1. - Try to create a pod named `good-pod-1` in the `default` namespace that doesn't violate the restricted profile, expecting the creation to succeed.
- Try to create a pod named `good-pod-2` whose image is `nginx` in the `staging-ns` namespace and the `spec.containers[*].securityContext.runAsUser` is set to 0, expecting the creation to succeed.
- Try to create a pod named `bad-pod-1` whose image is `nginx` in the `staging-ns` namespace and the `spec.containers[*].securityContext.runAsUser` is set to 0 and the `spec.initContainers[*].securityContext.runAsNonRoot` is set to 0, expecting the creation to fail.
- Try to create a pod named `bad-pod-2` whose image is `busybox` in the `staging-ns` namespace and the `spec.containers[*].securityContext.runAsUser` is set to 0, expecting the creation to fail.
- Try to create a pod named `bad-pod-3` whose image is `nginx` in the `default` namespace and the `spec.containers[*].securityContext.runAsUser` is set to 0, expecting the creation to fail.

44
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot-user/chainsaw-test.yaml Executable file
View file

@ -0,0 +1,44 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
creationTimestamp: null
name: exclude-running-as-nonroot-user
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: step-02
try:
- apply:
file: ns.yaml
- assert:
file: ns.yaml
- name: step-03
try:
- apply:
file: exception.yaml
- name: step-04
try:
- apply:
file: pod-allowed-1.yaml
- apply:
file: pod-allowed-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-1.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-3.yaml

22
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot-user/exception.yaml Normal file
View file

@ -0,0 +1,22 @@
apiVersion: kyverno.io/v2beta1
kind: PolicyException
metadata:
name: pod-security-exception
namespace: policy-exception-ns
spec:
exceptions:
- policyName: psa
ruleNames:
- restricted
match:
any:
- resources:
namespaces:
- staging-ns
podSecurity:
- controlName: "Running as Non-root user"
images:
- nginx
restrictedField: "spec.containers[*].securityContext.runAsUser"
values:
- "0"

9
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot-user/ns.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: v1
kind: Namespace
metadata:
name: policy-exception-ns
---
apiVersion: v1
kind: Namespace
metadata:
name: staging-ns

36
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot-user/pod-allowed-1.yaml Normal file
View file

@ -0,0 +1,36 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-1
namespace: default
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
runAsUser: 1
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
runAsUser: 1000
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

36
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot-user/pod-allowed-2.yaml Normal file
View file

@ -0,0 +1,36 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-2
namespace: staging-ns
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
runAsUser: 0
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
runAsUser: 10
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

36
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot-user/pod-rejected-1.yaml Normal file
View file

@ -0,0 +1,36 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-1
namespace: staging-ns
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
runAsUser: 0
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
runAsUser: 0
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

21
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot-user/pod-rejected-2.yaml Normal file
View file

@ -0,0 +1,21 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-2
namespace: staging-ns
spec:
containers:
- name: busybox1
image: busybox
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
runAsUser: 0
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

21
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot-user/pod-rejected-3.yaml Normal file
View file

@ -0,0 +1,21 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-3
namespace: default
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
runAsUser: 0
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

9
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot-user/policy-assert.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

18
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot-user/policy.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
spec:
background: true
validationFailureAction: Enforce
rules:
- name: restricted
match:
any:
- resources:
kinds:
- Pod
validate:
podSecurity:
level: restricted
version: latest

14
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot/README.md Normal file
View file

@ -0,0 +1,14 @@
## Description
This test creates a policy that enforces the restricted profile and a policy exception that exempts any pod whose image is `nginx` in the `staging-ns` namespace and sets the `spec.containers[*].securityContext.runAsNonRoot` field to `false`.
## Steps
1. - Create a cluster policy
- Assert the policy becomes ready
1. - Create a policy exception for the cluster policy created above.
1. - Try to create a pod named `good-pod-1` in the `default` namespace that doesn't violate the restricted profile, expecting the creation to succeed.
- Try to create a pod named `good-pod-2` whose image is `nginx` in the `staging-ns` namespace and the `spec.containers[*].securityContext.runAsNonRoot` is set to `false`, expecting the creation to succeed.
- Try to create a pod named `bad-pod-1` whose image is `nginx` in the `staging-ns` namespace and the `spec.containers[*].securityContext.runAsNonRoot` is set to `false` and the `spec.initContainers[*].securityContext.runAsNonRoot` is set to `false`, expecting the creation to fail.
- Try to create a pod named `bad-pod-2` whose image is `busybox` in the `staging-ns` namespace and the `spec.containers[*].securityContext.runAsNonRoot` is set to `false`, expecting the creation to fail.
- Try to create a pod named `bad-pod-3` whose image is `nginx` in the `default` namespace and the `spec.containers[*].securityContext.runAsNonRoot` is set to `false`, expecting the creation to fail.

44
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot/chainsaw-test.yaml Executable file
View file

@ -0,0 +1,44 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
creationTimestamp: null
name: exclude-running-as-nonroot
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: step-02
try:
- apply:
file: ns.yaml
- assert:
file: ns.yaml
- name: step-03
try:
- apply:
file: exception.yaml
- name: step-04
try:
- apply:
file: pod-allowed-1.yaml
- apply:
file: pod-allowed-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-1.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-3.yaml

22
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot/exception.yaml Normal file
View file

@ -0,0 +1,22 @@
apiVersion: kyverno.io/v2beta1
kind: PolicyException
metadata:
name: pod-security-exception
namespace: policy-exception-ns
spec:
exceptions:
- policyName: psa
ruleNames:
- restricted
match:
any:
- resources:
namespaces:
- staging-ns
podSecurity:
- controlName: "Running as Non-root"
images:
- nginx
restrictedField: "spec.containers[*].securityContext.runAsNonRoot"
values:
- "false"

9
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot/ns.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: v1
kind: Namespace
metadata:
name: policy-exception-ns
---
apiVersion: v1
kind: Namespace
metadata:
name: staging-ns

34
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot/pod-allowed-1.yaml Normal file
View file

@ -0,0 +1,34 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-1
namespace: default
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

34
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot/pod-allowed-2.yaml Normal file
View file

@ -0,0 +1,34 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-2
namespace: staging-ns
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: false
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

34
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot/pod-rejected-1.yaml Normal file
View file

@ -0,0 +1,34 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-1
namespace: staging-ns
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: false
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: false
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

20
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot/pod-rejected-2.yaml Normal file
View file

@ -0,0 +1,20 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-2
namespace: staging-ns
spec:
containers:
- name: busybox1
image: busybox
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: false
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

20
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot/pod-rejected-3.yaml Normal file
View file

@ -0,0 +1,20 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-3
namespace: default
spec:
containers:
- name: nginx
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
runAsNonRoot: false
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

9
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot/policy-assert.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

18
test/conformance/chainsaw/exceptions/exclude-running-as-nonroot/policy.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
spec:
background: true
validationFailureAction: Enforce
rules:
- name: restricted
match:
any:
- resources:
kinds:
- Pod
validate:
podSecurity:
level: restricted
version: latest

13
test/conformance/chainsaw/exceptions/exclude-seccomp/README.md Normal file
View file

@ -0,0 +1,13 @@
## Description
This test creates a policy that enforces the baseline profile and a policy exception that exempts any pod in the `staging-ns` namespace and sets the `spec.securityContext.seccompProfile.type` to `Unconfined`.
## Steps
1. - Create a cluster policy
- Assert the policy becomes ready
1. - Create a policy exception for the cluster policy created above.
1. - Try to create a pod named `good-pod-1` in the `default` namespace that doesn't violate the baseline profile, expecting the creation to succeed.
- Try to create a pod named `good-pod-2` in the `staging-ns` namespace and the `spec.securityContext.seccompProfile.type` is set to `Unconfined` and the `spec.containers[*].securityContext.seccompProfile.type` is set to `RuntimeDefault`, expecting the creation to succeed.
- Try to create a pod named `bad-pod-1` in the `staging-ns` namespace and the `spec.securityContext.seccompProfile.type` is set to `Unconfined` and the `spec.containers[*].securityContext.seccompProfile.type` is set to `Unconfined`, expecting the creation to fail.
- Try to create a pod named `bad-pod-2` in the `default` namespace and the `spec.securityContext.seccompProfile.type` is set to `Unconfined` and the `spec.containers[*].securityContext.seccompProfile.type` is set to `Unconfined`, expecting the creation to fail.

39
test/conformance/chainsaw/exceptions/exclude-seccomp/chainsaw-test.yaml Executable file
View file

@ -0,0 +1,39 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
creationTimestamp: null
name: exclude-seccomp
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: step-02
try:
- apply:
file: ns.yaml
- assert:
file: ns.yaml
- name: step-03
try:
- apply:
file: exception.yaml
- name: step-04
try:
- apply:
file: pod-allowed-1.yaml
- apply:
file: pod-allowed-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-1.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-2.yaml

20
test/conformance/chainsaw/exceptions/exclude-seccomp/exception.yaml Normal file
View file

@ -0,0 +1,20 @@
apiVersion: kyverno.io/v2beta1
kind: PolicyException
metadata:
name: pod-security-exception
namespace: policy-exception-ns
spec:
exceptions:
- policyName: psa
ruleNames:
- baseline
match:
any:
- resources:
namespaces:
- staging-ns
podSecurity:
- controlName: "Seccomp"
restrictedField: "spec.securityContext.seccompProfile.type"
values:
- "Unconfined"

9
test/conformance/chainsaw/exceptions/exclude-seccomp/ns.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: v1
kind: Namespace
metadata:
name: policy-exception-ns
---
apiVersion: v1
kind: Namespace
metadata:
name: staging-ns

24
test/conformance/chainsaw/exceptions/exclude-seccomp/pod-allowed-1.yaml Normal file
View file

@ -0,0 +1,24 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-1
namespace: default
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d

18
test/conformance/chainsaw/exceptions/exclude-seccomp/pod-allowed-2.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-2
namespace: staging-ns
spec:
securityContext:
seccompProfile:
type: Unconfined
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: RuntimeDefault

18
test/conformance/chainsaw/exceptions/exclude-seccomp/pod-rejected-1.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-1
namespace: staging-ns
spec:
securityContext:
seccompProfile:
type: Unconfined
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: Unconfined

18
test/conformance/chainsaw/exceptions/exclude-seccomp/pod-rejected-2.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-2
namespace: default
spec:
securityContext:
seccompProfile:
type: Unconfined
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seccompProfile:
type: Unconfined

9
test/conformance/chainsaw/exceptions/exclude-seccomp/policy-assert.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

18
test/conformance/chainsaw/exceptions/exclude-seccomp/policy.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
spec:
background: true
validationFailureAction: Enforce
rules:
- name: baseline
match:
any:
- resources:
kinds:
- Pod
validate:
podSecurity:
level: baseline
version: latest

17
test/conformance/chainsaw/exceptions/exclude-selinux/README.md Normal file
View file

@ -0,0 +1,17 @@
## Description
This test creates a policy that enforces the baseline profile and a policy exception that exempts any pod whose image is `nginx` in the `staging-ns` namespace and fields:
1. `spec.containers[*].securityContext.seLinuxOptions.type` is set to `foo`.
2. `spec.initContainers[*].securityContext.seLinuxOptions.type` is set to `bar`.
## Steps
1. - Create a cluster policy
- Assert the policy becomes ready
1. - Create a policy exception for the cluster policy created above.
1. - Try to create a pod named `good-pod-1` in the `default` namespace that doesn't violate the baseline profile, expecting the creation to succeed.
- Try to create a pod named `good-pod-2` whose image is `nginx` in the `staging-ns` namespace with `spec.containers[*].securityContext.seLinuxOptions.type` set to `foo` and `spec.initContainers[*].securityContext.seLinuxOptions.type` set to `bar`, expecting the creation to succeed.
- Try to create a pod named `bad-pod-1` whose image is `nginx` in the `staging-ns` namespace with `spec.containers[*].securityContext.seLinuxOptions.type` set to `bar` and `spec.initContainers[*].securityContext.seLinuxOptions.type` set to `foo`, expecting the creation to fail.
- Try to create a pod named `bad-pod-2` whose image is `busybox` in the `staging-ns` namespace with `spec.containers[*].securityContext.seLinuxOptions.type` set to `foo` and `spec.initContainers[*].securityContext.seLinuxOptions.type` set to `bar`, expecting the creation to fail.
- Try to create a pod named `bad-pod-3` whose image is `nginx` in the `staging-ns` namespace with `spec.containers[*].securityContext.seLinuxOptions.type` set to `foo` and `spec.ephemeralContainers[*].securityContext.capabilities.add` set to `bar`, expecting the creation to fail.
- Try to create a pod named `bad-pod-4` whose image is `nginx` in the `default` namespace with `spec.containers[*].securityContext.seLinuxOptions.type` set to `foo` and `spec.initContainers[*].securityContext.seLinuxOptions.type` set to `bar`, expecting the creation to fail.

49
test/conformance/chainsaw/exceptions/exclude-selinux/chainsaw-test.yaml Executable file
View file

@ -0,0 +1,49 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
creationTimestamp: null
name: exclude-selinux
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: step-02
try:
- apply:
file: ns.yaml
- assert:
file: ns.yaml
- name: step-03
try:
- apply:
file: exception.yaml
- name: step-04
try:
- apply:
file: pod-allowed-1.yaml
- apply:
file: pod-allowed-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-1.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-3.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-4.yaml

28
test/conformance/chainsaw/exceptions/exclude-selinux/exception.yaml Normal file
View file

@ -0,0 +1,28 @@
apiVersion: kyverno.io/v2beta1
kind: PolicyException
metadata:
name: pod-security-exception
namespace: policy-exception-ns
spec:
exceptions:
- policyName: psa
ruleNames:
- baseline
match:
any:
- resources:
namespaces:
- staging-ns
podSecurity:
- controlName: "SELinux"
images:
- nginx
restrictedField: "spec.containers[*].securityContext.seLinuxOptions.type"
values:
- "foo"
- controlName: "SELinux"
images:
- nginx
restrictedField: "spec.initContainers[*].securityContext.seLinuxOptions.type"
values:
- "bar"

9
test/conformance/chainsaw/exceptions/exclude-selinux/ns.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: v1
kind: Namespace
metadata:
name: policy-exception-ns
---
apiVersion: v1
kind: Namespace
metadata:
name: staging-ns

24
test/conformance/chainsaw/exceptions/exclude-selinux/pod-allowed-1.yaml Normal file
View file

@ -0,0 +1,24 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-1
namespace: default
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seLinuxOptions:
type: container_t
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seLinuxOptions:
type: container_init_t

24
test/conformance/chainsaw/exceptions/exclude-selinux/pod-allowed-2.yaml Normal file
View file

@ -0,0 +1,24 @@
apiVersion: v1
kind: Pod
metadata:
name: good-pod-2
namespace: staging-ns
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seLinuxOptions:
type: foo
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seLinuxOptions:
type: bar

24
test/conformance/chainsaw/exceptions/exclude-selinux/pod-rejected-1.yaml Normal file
View file

@ -0,0 +1,24 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-1
namespace: staging-ns
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seLinuxOptions:
type: bar
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seLinuxOptions:
type: foo

24
test/conformance/chainsaw/exceptions/exclude-selinux/pod-rejected-2.yaml Normal file
View file

@ -0,0 +1,24 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-2
namespace: staging-ns
spec:
containers:
- name: busybox1
image: busybox
args:
- sleep
- 1d
securityContext:
seLinuxOptions:
type: foo
initContainers:
- name: busybox2
image: busybox
args:
- sleep
- 1d
securityContext:
seLinuxOptions:
type: bar

24
test/conformance/chainsaw/exceptions/exclude-selinux/pod-rejected-3.yaml Normal file
View file

@ -0,0 +1,24 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-3
namespace: staging-ns
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seLinuxOptions:
type: foo
ephemeralContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seLinuxOptions:
type: bar

24
test/conformance/chainsaw/exceptions/exclude-selinux/pod-rejected-4.yaml Normal file
View file

@ -0,0 +1,24 @@
apiVersion: v1
kind: Pod
metadata:
name: bad-pod-4
namespace: default
spec:
containers:
- name: nginx1
image: nginx
args:
- sleep
- 1d
securityContext:
seLinuxOptions:
type: foo
initContainers:
- name: nginx2
image: nginx
args:
- sleep
- 1d
securityContext:
seLinuxOptions:
type: bar

9
test/conformance/chainsaw/exceptions/exclude-selinux/policy-assert.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

18
test/conformance/chainsaw/exceptions/exclude-selinux/policy.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
spec:
background: true
validationFailureAction: Enforce
rules:
- name: baseline
match:
any:
- resources:
kinds:
- Pod
validate:
podSecurity:
level: baseline
version: latest

13
test/conformance/chainsaw/exceptions/exclude-sysctls/README.md Normal file
View file

@ -0,0 +1,13 @@
## Description
This test creates a policy that enforces the baseline profile and a policy exception that exempts any pod whose namespace is `staging-ns` namespace and sets the `spec.securityContext.sysctls[*].name` to `fake.value`.
## Steps
1. - Create a cluster policy
- Assert the policy becomes ready
1. - Create a policy exception for the cluster policy created above.
1. - Try to create a pod named `good-pod-1` in the `default` namespace whose `spec.securityContext.sysctls[0].name` field is set to `net.ipv4.ip_unprivileged_port_start`, expecting the creation to succeed.
- Try to create a pod named `good-pod-2` in the `staging-ns` namespace whose `spec.securityContext.sysctls[0].name` field is set to `fake.value`, expecting the creation to succeed.
- Try to create a pod named `bad-pod-1` in the `staging-ns` namespace whose `spec.securityContext.sysctls[0].name` field is set to `unknown`, expecting the creation to fail.
- Try to create a pod named `bad-pod-2` in the `default` namespace whose `spec.securityContext.sysctls[0].name` field is set to `fake.value`, expecting the creation to fail.

39
test/conformance/chainsaw/exceptions/exclude-sysctls/chainsaw-test.yaml Executable file
View file

@ -0,0 +1,39 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
creationTimestamp: null
name: exclude-sysctls
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: step-02
try:
- apply:
file: ns.yaml
- assert:
file: ns.yaml
- name: step-03
try:
- apply:
file: exception.yaml
- name: step-04
try:
- apply:
file: pod-allowed-1.yaml
- apply:
file: pod-allowed-2.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-1.yaml
- apply:
expect:
- check:
($error != null): true
file: pod-rejected-2.yaml

20
test/conformance/chainsaw/exceptions/exclude-sysctls/exception.yaml Normal file
View file

@ -0,0 +1,20 @@
apiVersion: kyverno.io/v2beta1
kind: PolicyException
metadata:
name: pod-security-exception
namespace: policy-exception-ns
spec:
exceptions:
- policyName: psa
ruleNames:
- baseline
match:
any:
- resources:
namespaces:
- staging-ns
podSecurity:
- controlName: "Sysctls"
restrictedField: "spec.securityContext.sysctls[*].name"
values:
- "fake.value"

Some files were not shown because too many files have changed in this diff Show more