mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-31 03:45:17 +00:00
Code Activity

add disallow_readonly_rootfilesystem.yaml

Browse source
This commit is contained in:
Shuting Zhao 2019-10-08 22:05:15 -07:00
parent c755df6b70
commit cb44585d70
4 changed files with 21 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
pkg/testrunner/testrunner_test.go
View file

@ -97,7 +97,7 @@ func Test_validate_hostPID_hostIPC(t *testing.T) {
} }
func Test_validate_not_readonly_rootfilesystem(t *testing.T) { func Test_validate_not_readonly_rootfilesystem(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_not_readonly_rootfilesystem.yaml") testScenario(t, "test/scenarios/test/scenario_validate_disallow_readonly_rootfilesystem.yaml")
} }
func Test_validate_namespace_quota(t *testing.T) { func Test_validate_namespace_quota(t *testing.T) {

18
samples/best_practices/disallow_readonly_rootfilesystem.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: kyverno.io/v1alpha1
kind: ClusterPolicy
metadata:
name: validate-not-readonly-rootfilesystem
spec:
rules:
- name: validate-not-readonly-rootfilesystem
match:
resources:
kinds:
- Pod
validate:
message: "Container should not have read-only rootfilesystem"
pattern:
spec:
containers:
- securityContext:
readOnlyRootFilesystem: false

0
examples/best_practices/resources/resource_validate_not_readonly_rootfilesystem.yaml → test/manifest/disallow_readonly_rootfilesystem.yaml
View file

4
test/scenarios/test/scenario_validate_not_readonly_rootfilesystem.yaml → test/scenarios/test/scenario_validate_disallow_readonly_rootfilesystem.yaml
View file

@ -1,7 +1,7 @@
# file path relative to project root # file path relative to project root
input: input:
policy: examples/best_practices/policy_validate_not_readonly_rootfilesystem.yaml policy: samples/best_practices/disallow_readonly_rootfilesystem.yaml
resource: examples/best_practices/resources/resource_validate_not_readonly_rootfilesystem.yaml resource: test/manifest/disallow_readonly_rootfilesystem.yaml
expected: expected:
validation: validation:
policyresponse: policyresponse: