add disallow_readonly_rootfilesystem.yaml

pkg/testrunner/testrunner_test.go

@@ -97,7 +97,7 @@ func Test_validate_hostPID_hostIPC(t *testing.T) {
 }
 
 func Test_validate_not_readonly_rootfilesystem(t *testing.T) {
-	testScenario(t, "test/scenarios/test/scenario_validate_not_readonly_rootfilesystem.yaml")
+	testScenario(t, "test/scenarios/test/scenario_validate_disallow_readonly_rootfilesystem.yaml")
 }
 
 func Test_validate_namespace_quota(t *testing.T) {

samples/best_practices/disallow_readonly_rootfilesystem.yaml

@@ -0,0 +1,18 @@
+apiVersion: kyverno.io/v1alpha1
+kind: ClusterPolicy
+metadata:
+  name: validate-not-readonly-rootfilesystem
+spec:
+  rules:
+  - name: validate-not-readonly-rootfilesystem
+    match:
+      resources:
+        kinds:
+        - Pod
+    validate:
+      message: "Container should not have read-only rootfilesystem"
+      pattern:
+        spec:
+          containers:
+          - securityContext:
+              readOnlyRootFilesystem: false

test/scenarios/test/scenario_validate_disallow_readonly_rootfilesystem.yaml

@@ -1,7 +1,7 @@
 # file path relative to project root
 input:
-  policy: examples/best_practices/policy_validate_not_readonly_rootfilesystem.yaml
-  resource: examples/best_practices/resources/resource_validate_not_readonly_rootfilesystem.yaml
+  policy: samples/best_practices/disallow_readonly_rootfilesystem.yaml
+  resource: test/manifest/disallow_readonly_rootfilesystem.yaml
 expected:
   validation:
     policyresponse: