diff --git a/examples/best_practices/policy_validate_default_namespace.yaml b/examples/best_practices/policy_validate_default_namespace.yaml index adb1791656..e77dc7394a 100644 --- a/examples/best_practices/policy_validate_default_namespace.yaml +++ b/examples/best_practices/policy_validate_default_namespace.yaml @@ -5,6 +5,16 @@ metadata: spec: rules: - name: check-default-namespace + match: + resources: + kinds: + - Pod + validate: + message: "A none 'default' namespace is required" + anyPattern: + - metadata: + namespace: "!default" + - name: check-namespace-exist match: resources: kinds: @@ -14,5 +24,3 @@ spec: anyPattern: - metadata: namespace: "?*" - - metadata: - namespace: "!default" diff --git a/examples/best_practices/resources/resource_default_namespace.yaml b/examples/best_practices/resources/resource_default_namespace.yaml index c83c830f72..1d986b3c99 100644 --- a/examples/best_practices/resources/resource_default_namespace.yaml +++ b/examples/best_practices/resources/resource_default_namespace.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: Pod metadata: name: myapp-pod + namespace: default labels: app: myapp spec: diff --git a/pkg/testrunner/testrunner_test.go b/pkg/testrunner/testrunner_test.go index 9e512dc6a3..a8e0152edd 100644 --- a/pkg/testrunner/testrunner_test.go +++ b/pkg/testrunner/testrunner_test.go @@ -79,3 +79,7 @@ func Test_validate_image_tag_latest_pass(t *testing.T) { func Test_mutate_pod_disable_automoutingapicred_pass(t *testing.T) { testScenario(t, "test/scenarios/test/scenario_mutate_pod_disable_automountingapicred.yaml") } + +func Test_validate_default_namespace(t *testing.T) { + testScenario(t, "test/scenarios/test/scenario_validate_default_namespace.yaml") +} diff --git a/test/scenarios/test/scenario_validate_default_namespace.yaml b/test/scenarios/test/scenario_validate_default_namespace.yaml new file mode 100644 index 0000000000..aec3c79221 --- /dev/null +++ b/test/scenarios/test/scenario_validate_default_namespace.yaml @@ -0,0 +1,25 @@ +# file path relative to project root +input: + policy: examples/best_practices/policy_validate_default_namespace.yaml + resource: examples/best_practices/resources/resource_default_namespace.yaml +expected: + validation: + policyresponse: + policy: validate-namespace + resource: + kind: Pod + apiVersion: v1 + # this is set to pass resource NS check + # actual valiation is defined through rule success=false + namespace: 'default' + name: myapp-pod + rules: + - name: check-default-namespace + type: Validation + message: "Validation rule 'check-default-namespace' failed to validate patterns defined in anyPattern. A none 'default' namespace is required; anyPattern[0] failed at path /metadata/namespace/" + success: false + - name: check-namespace-exist + type: Validation + message: "Validation rule 'check-namespace-exist' anyPattern[0] succesfully validated" + success: true +