update testrunner for examples/best_practices/policy_validate_container_security_context.yaml

examples/best_practices/policy_validate_container_security_context.yaml

@@ -20,12 +20,6 @@ spec:
       - spec:
           securityContext:
             runAsNonRoot: true
-      # pattern:
-      #   spec:
-      #     containers:
-      #     - name: "*"
-      #       securityContext:
-      #         runAsNonRoot: true
   - name: check-privilege
     exclude:
       resources:
@@ -37,15 +31,10 @@ spec:
         - Pod
     validate:
       message: "Privileged mode is not allowed. Set allowPrivilegeEscalatin and privileged to false"
-      anyPattern:
-      - spec:
-        securityContext:
-          allowPrivilegeEscalation: false
-          privileged: false
-      # pattern:
-      #   spec:
-      #     containers:
-      #     - name: "*"
-      #       securityContext:
-      #         allowPrivilegeEscalation: false
-      #         privileged: false
+      pattern:
+        spec:
+          containers:
+          - name: "*"
+            securityContext:
+              allowPrivilegeEscalation: false
+              privileged: false

examples/best_practices/resources/resource_validate_container_security_context.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: check-container-security-context
+spec:
+  securityContext:
+    runAsNonRoot: true
+  containers:
+  - name: check-container-security-context
+    image: nginxinc/nginx-unprivileged
+    securityContext:
+      allowPrivilegeEscalation: true
+      privileged: false

pkg/testrunner/testrunner_test.go

@@ -18,6 +18,10 @@ func Test_validate_containerSecurityContext(t *testing.T) {
 	testScenario(t, "/test/scenarios/test/scenario_validate_containerSecurityContext.yaml")
 }
 
+func Test_validate_checkContainerSecurityContext(t *testing.T) {
+	testScenario(t, "/test/scenarios/test/scenario_validate_container_security_context.yaml")
+}
+
 func Test_validate_healthChecks(t *testing.T) {
 	testScenario(t, "/test/scenarios/test/scenario_validate_healthChecks.yaml")
 }

test/scenarios/test/scenario_validate_container_security_context.yaml

@@ -0,0 +1,22 @@
+# file path relative to project root
+input:
+  policy: examples/best_practices/policy_validate_container_security_context.yaml
+  resource: examples/best_practices/resources/resource_validate_container_security_context.yaml
+expected:
+  validation:
+    policyresponse:
+      policy: check-container-security-context
+      resource:
+        kind: Pod
+        apiVersion: v1
+        namespace: ''
+        name: check-container-security-context
+      rules:
+        - name: check-root-user
+          type: Validation
+          message: "Validation rule 'check-root-user' anyPattern[0] succesfully validated"
+          success: true
+        - name: check-privilege
+          type: Validation
+          message: "Validation rule 'check-privilege' failed at '/spec/containers/0/securityContext/allowPrivilegeEscalation/' for resource Pod//check-container-security-context. Privileged mode is not allowed. Set allowPrivilegeEscalatin and privileged to false"
+          success: false