mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-29 10:55:05 +00:00
Code Activity

using anyPattern for allowed image registries

Browse source
This commit is contained in:
Shuting Zhao 2019-10-07 14:34:32 -07:00
parent 465d999aba
commit cac41d9fda
5 changed files with 38 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
examples/best_practices/README.md
View file

@ -9,7 +9,7 @@
| Disallow hostPID and hostIPC | [policy_validate_hostpid_hosipc.yaml](policy_validate_hostpid_hosipc.yaml) |
| Require read only root filesystem | [policy_validate_not_readonly_rootfilesystem.yaml](policy_validate_not_readonly_rootfilesystem.yaml) |
| Disallow node ports | [policy_validate_disallow_node_port.yaml](policy_validate_disallow_node_port.yaml) |
| Allow trusted registries | [policy_validate_image_registries.yaml](policy_validate_image_registries.yaml) |
| Allow trusted registries | [policy_validate_whitelist_image_registries.yaml](policy_validate_whitelist_image_registries.yaml) |
| Require resource requests and limits | [policy_validate_pod_resources.yaml](policy_validate_pod_resources.yaml) |
| Require pod liveness and readiness probes | [policy_validate_pod_probes.yaml](policy_validate_pod_probes.yaml) |
| Require an image tag | [policy_validate_image_tag_notspecified_deny.yaml](policy_validate_image_tag_notspecified_deny.yaml) |

13
examples/best_practices/policy_validate_image_registries.yaml → examples/best_practices/policy_validate_whitelist_image_registries.yaml
View file

@ -10,10 +10,11 @@ spec:
kinds:
- Pod
validate:
message: "Image registry is not allowed"
pattern:
spec:
message: "White list of image registries"
anyPattern:
- spec:
containers:
- name: "*"
# Check allowed registries
image: "*nirmata* | https://private.registry.io/*"
- image: "https://private.registry.io/*"
- spec:
containers:
- image: "*nirmata*"

8
examples/best_practices/resources/resource_validate_whitelist_image_registries.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: v1
kind: Pod
metadata:
name: nirmata-nginx
spec:
containers:
- name: nirmata-nginx
image: nirmata/nginx

4
pkg/testrunner/testrunner_test.go
View file

@ -135,3 +135,7 @@ func Test_validate_disallow_sysctl(t *testing.T) {
func Test_validate_volume_whitelist(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_volume_whiltelist.yaml")
}
func Test_validate_whitelist_image_registries(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_whitelist_image_registries.yaml")
}

18
test/scenarios/test/scenario_validate_whitelist_image_registries.yaml Normal file
View file

@ -0,0 +1,18 @@
# file path relative to project root
input:
policy: examples/best_practices/policy_validate_whitelist_image_registries.yaml
resource: examples/best_practices/resources/resource_validate_whitelist_image_registries.yaml
expected:
validation:
policyresponse:
policy: validate-image-registry
resource:
kind: Pod
apiVersion: v1
namespace: ''
name: nirmata-nginx
rules:
- name: validate-image-registry
type: Validation
message: Validation rule 'validate-image-registry' anyPattern[1] succesfully validated
success: true