chore: use more chainsaw step templates (#11317)

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

test/conformance/chainsaw/validate/anchors/conditional-deprecated/chainsaw-test.yaml

@@ -4,35 +4,43 @@ metadata:
   name: conditional-anchor
 spec:
   steps:
-    - name: apply-namespace
+  - name: apply-namespace
-      try:
+    try:
-        - apply:
+      - apply:
-            file: namespace.yaml
+          file: namespace.yaml
-    - name: apply-policy
+  - name: create policy
-      try:
+    use:
-        - apply:
+      template: ../../../_step-templates/create-policy.yaml
-            file: policy.yaml
+      with:
-        - assert:
+        bindings:
-            file: policy-ready.yaml
+        - name: file
-    - name: apply-labelled-resource
+          value: policy.yaml
-      try:
+  - name: wait policy ready
-        - apply:
+    use:
-            file: labelled-resource.yaml
+      template: ../../../_step-templates/cluster-policy-ready.yaml
-    - name: apply-unlabelled-resource
+      with:
-      try:
+        bindings:
-        - apply:
+        - name: name
-            file: unlabelled-resource.yaml
+          value: restrict-scale
-    - name: apply-scaling
+  - name: apply-labelled-resource
-      try:
+    try:
-        - script:
+      - apply:
-            content:
+          file: labelled-resource.yaml
-              "if kubectl -n test-anchors scale deployment labelled-deployment --replicas 2\nthen
+  - name: apply-unlabelled-resource
-              \n  exit 0\nelse \n  exit 1\nfi\n"
+    try:
-        - script:
+      - apply:
-            content:
+          file: unlabelled-resource.yaml
-              "if kubectl -n test-anchors scale deployment labelled-deployment --replicas 9\nthen
+  - name: apply-scaling
-              \n  exit 1\nelse \n  exit 0\nfi\n"
+    try:
-        - script:
+      - script:
-            content:
+          content:
-              "if kubectl -n test-anchors scale deployment unlabelled-deployment --replicas 9\nthen
+            "if kubectl -n test-anchors scale deployment labelled-deployment --replicas 2\nthen
-              \n  exit 0\nelse \n  exit 1\nfi\n"
+            \n  exit 0\nelse \n  exit 1\nfi\n"
+      - script:
+          content:
+            "if kubectl -n test-anchors scale deployment labelled-deployment --replicas 9\nthen
+            \n  exit 1\nelse \n  exit 0\nfi\n"
+      - script:
+          content:
+            "if kubectl -n test-anchors scale deployment unlabelled-deployment --replicas 9\nthen
+            \n  exit 0\nelse \n  exit 1\nfi\n"

test/conformance/chainsaw/validate/anchors/conditional-deprecated/policy-ready.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: restrict-scale
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/anchors/conditional/chainsaw-test.yaml

@@ -4,35 +4,43 @@ metadata:
   name: conditional-anchor
 spec:
   steps:
-    - name: apply-namespace
+  - name: apply-namespace
-      try:
+    try:
-        - apply:
+      - apply:
-            file: namespace.yaml
+          file: namespace.yaml
-    - name: apply-policy
+  - name: create policy
-      try:
+    use:
-        - apply:
+      template: ../../../_step-templates/create-policy.yaml
-            file: policy.yaml
+      with:
-        - assert:
+        bindings:
-            file: policy-ready.yaml
+        - name: file
-    - name: apply-labelled-resource
+          value: policy.yaml
-      try:
+  - name: wait policy ready
-        - apply:
+    use:
-            file: labelled-resource.yaml
+      template: ../../../_step-templates/cluster-policy-ready.yaml
-    - name: apply-unlabelled-resource
+      with:
-      try:
+        bindings:
-        - apply:
+        - name: name
-            file: unlabelled-resource.yaml
+          value: restrict-scale
-    - name: apply-scaling
+  - name: apply-labelled-resource
-      try:
+    try:
-        - script:
+      - apply:
-            content:
+          file: labelled-resource.yaml
-              "if kubectl -n test-anchors scale deployment labelled-deployment --replicas 2\nthen
+  - name: apply-unlabelled-resource
-              \n  exit 0\nelse \n  exit 1\nfi\n"
+    try:
-        - script:
+      - apply:
-            content:
+          file: unlabelled-resource.yaml
-              "if kubectl -n test-anchors scale deployment labelled-deployment --replicas 9\nthen
+  - name: apply-scaling
-              \n  exit 1\nelse \n  exit 0\nfi\n"
+    try:
-        - script:
+      - script:
-            content:
+          content:
-              "if kubectl -n test-anchors scale deployment unlabelled-deployment --replicas 9\nthen
+            "if kubectl -n test-anchors scale deployment labelled-deployment --replicas 2\nthen
-              \n  exit 0\nelse \n  exit 1\nfi\n"
+            \n  exit 0\nelse \n  exit 1\nfi\n"
+      - script:
+          content:
+            "if kubectl -n test-anchors scale deployment labelled-deployment --replicas 9\nthen
+            \n  exit 1\nelse \n  exit 0\nfi\n"
+      - script:
+          content:
+            "if kubectl -n test-anchors scale deployment unlabelled-deployment --replicas 9\nthen
+            \n  exit 0\nelse \n  exit 1\nfi\n"

test/conformance/chainsaw/validate/anchors/conditional/policy-ready.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: restrict-scale
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/apply-on-deletion-deprecated/chainsaw-test.yaml

@@ -4,12 +4,20 @@ metadata:
   name: apply-on-deletion
 spec:
   steps:
-  - name: step-01
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-ready.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: cpol-apply-on-deletion
   - name: step-02
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/cornercases/apply-on-deletion-deprecated/policy-ready.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: cpol-apply-on-deletion 
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/apply-on-deletion/chainsaw-test.yaml

@@ -4,12 +4,20 @@ metadata:
   name: apply-on-deletion
 spec:
   steps:
-  - name: step-01
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-ready.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: cpol-apply-on-deletion
   - name: step-02
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/cornercases/apply-on-deletion/policy-ready.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: cpol-apply-on-deletion 
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/cel-messages-upon-resource-failure-deprecated/chainsaw-test.yaml

@@ -4,12 +4,20 @@ metadata:
   name: cel-messages-upon-resource-failure
 spec:
   steps:
-  - name: step-01
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: disallow-host-port-in-pods
   - name: step-02
     try:
     - script:

test/conformance/chainsaw/validate/clusterpolicy/cornercases/cel-messages-upon-resource-failure-deprecated/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: disallow-host-port-in-pods
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/cel-messages-upon-resource-failure/chainsaw-test.yaml

@@ -4,12 +4,20 @@ metadata:
   name: cel-messages-upon-resource-failure
 spec:
   steps:
-  - name: step-01
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: disallow-host-port-in-pods
   - name: step-02
     try:
     - script:

test/conformance/chainsaw/validate/clusterpolicy/cornercases/cel-messages-upon-resource-failure/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: disallow-host-port-in-pods
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure-deprecated/chainsaw-test.yaml

@@ -4,18 +4,34 @@ metadata:
   name: check-message-upon-resource-failure
 spec:
   steps:
-  - name: step-01
+  - name: create policy
-    try: 
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: policy-1.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert1.yaml    
+        - name: file
-  - name: step-02
+          value: policy-1.yaml
-    try:
+  - name: wait policy ready
-    - apply:
+    use:
-        file: policy-2.yaml
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
-    - assert:
+      with:
-        file: policy-assert2.yaml    
+        bindings:
+        - name: name
+          value: require-ns-owner-label
+  - name: create policy
+    use:
+      template: ../../../../_step-templates/create-policy.yaml
+      with:
+        bindings:
+        - name: file
+          value: policy-2.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: preconditions-check
   - name: step-03
     try:
     - script:

test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure-deprecated/policy-assert1.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: require-ns-owner-label
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure-deprecated/policy-assert2.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: preconditions-check
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/chainsaw-test.yaml

@@ -4,18 +4,34 @@ metadata:
   name: check-message-upon-resource-failure
 spec:
   steps:
-  - name: step-01
+  - name: create policy
-    try: 
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: policy-1.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert1.yaml    
+        - name: file
-  - name: step-02
+          value: policy-1.yaml
-    try:
+  - name: wait policy ready
-    - apply:
+    use:
-        file: policy-2.yaml
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
-    - assert:
+      with:
-        file: policy-assert2.yaml    
+        bindings:
+        - name: name
+          value: require-ns-owner-label
+  - name: create policy
+    use:
+      template: ../../../../_step-templates/create-policy.yaml
+      with:
+        bindings:
+        - name: file
+          value: policy-2.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: preconditions-check
   - name: step-03
     try:
     - script:

test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/policy-assert1.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: require-ns-owner-label
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/policy-assert2.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: preconditions-check
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/different-configuration-for-actions/chainsaw-test.yaml

@@ -4,20 +4,28 @@ metadata:
   name: different-configuration-for-actions
 spec:
   steps:
-    - name: step-01
+  - name: create policy
-      try:
+    use:
-        - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-            file: policy.yaml
+      with:
-        - assert:
+        bindings:
-            file: policy-assert.yaml
+        - name: file
-    - name: step-02
+          value: policy.yaml
-      try:
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: check-ns-labels
+  - name: step-02
+    try:
+    - apply:
+        file: good-resources.yaml
+  - name: step-03
+    try:
       - apply:
-          file: good-resources.yaml
+          expect:
-    - name: step-03
+            - check:
-      try:
+                ($error != null): true
-        - apply:
+          file: bad-resources.yaml
-            expect:
-              - check:
-                  ($error != null): true
-            file: bad-resources.yaml

test/conformance/chainsaw/validate/clusterpolicy/cornercases/different-configuration-for-actions/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: check-ns-labels
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/ephemeral-containers-deprecated/chainsaw-test.yaml

@@ -4,12 +4,20 @@ metadata:
   name: ephemeral-containers
 spec:
   steps:
-  - name: step-01
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-ready.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: restrict-image-registries
   - name: step-02
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/cornercases/ephemeral-containers-deprecated/policy-ready.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: restrict-image-registries
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/ephemeral-containers/chainsaw-test.yaml

@@ -4,12 +4,20 @@ metadata:
   name: ephemeral-containers
 spec:
   steps:
-  - name: step-01
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-ready.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: restrict-image-registries
   - name: step-02
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/cornercases/ephemeral-containers/policy-ready.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: restrict-image-registries
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/external-metrics-deprecated/chainsaw-test.yaml

@@ -10,15 +10,26 @@ spec:
         file: keda.yaml
     - assert:
         file: keda-ready.yaml
-  - name: step-01
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: cluster-policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: cluster-policy-ready.yaml
+        - name: file
-  - name: step-02
+          value: policy.yaml
-    try:
+  - name: wait policy ready
-    - apply:
+    use:
-        file: policy.yaml
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
-    - assert:
+      with:
-        file: policy-ready.yaml
+        bindings:
+        - name: name
+          value: external-metrics-policy
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: external-metrics-policy-default
+        - name: namespace
+          value: default

test/conformance/chainsaw/validate/clusterpolicy/cornercases/external-metrics-deprecated/cluster-policy-ready.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-    name: external-metrics-policy
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/external-metrics-deprecated/cluster-policy.yaml

@@ -1,30 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-    name: external-metrics-policy
-spec:
-  validationFailureAction: Enforce
-  background: false
-  rules:
-  - name: external-metrics-rule
-    match:
-      all:
-      - clusterRoles:
-        - evil-cr
-        resources:
-          kinds:
-          - Secret
-    validate:
-      message: 'You should be careful when trying to change/delete {{request.oldObject.kind}} in {{request.oldObject.name}}. These are my-precious resources and touching them might break my heart.'
-      deny:
-        conditions:
-          any:
-          - key: '{{request.operation}}'
-            operator: Equals
-            value: DELETE
-          - key: '{{request.operation}}'
-            operator: Equals
-            value: UPDATE
-          - key: '{{request.operation}}'
-            operator: Equals
-            value: CREATE

test/conformance/chainsaw/validate/clusterpolicy/cornercases/external-metrics-deprecated/policy-ready.yaml

@@ -1,10 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: Policy
-metadata:
-    name: external-metrics-policy-default
-    namespace: default
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/external-metrics-deprecated/policy.yaml

@@ -1,4 +1,35 @@
 apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+    name: external-metrics-policy
+spec:
+  validationFailureAction: Enforce
+  background: false
+  rules:
+  - name: external-metrics-rule
+    match:
+      all:
+      - clusterRoles:
+        - evil-cr
+        resources:
+          kinds:
+          - Secret
+    validate:
+      message: 'You should be careful when trying to change/delete {{request.oldObject.kind}} in {{request.oldObject.name}}. These are my-precious resources and touching them might break my heart.'
+      deny:
+        conditions:
+          any:
+          - key: '{{request.operation}}'
+            operator: Equals
+            value: DELETE
+          - key: '{{request.operation}}'
+            operator: Equals
+            value: UPDATE
+          - key: '{{request.operation}}'
+            operator: Equals
+            value: CREATE
+---
+apiVersion: kyverno.io/v1
 kind: Policy
 metadata:
     name: external-metrics-policy-default
@@ -28,4 +59,4 @@ spec:
             value: UPDATE
           - key: '{{request.operation}}'
             operator: Equals
-            value: CREATE
+            value: CREATE

test/conformance/chainsaw/validate/clusterpolicy/cornercases/external-metrics/chainsaw-test.yaml

@@ -10,15 +10,26 @@ spec:
         file: keda.yaml
     - assert:
         file: keda-ready.yaml
-  - name: step-01
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: cluster-policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: cluster-policy-ready.yaml
+        - name: file
-  - name: step-02
+          value: policy.yaml
-    try:
+  - name: wait policy ready
-    - apply:
+    use:
-        file: policy.yaml
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
-    - assert:
+      with:
-        file: policy-ready.yaml
+        bindings:
+        - name: name
+          value: external-metrics-policy
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: external-metrics-policy-default
+        - name: namespace
+          value: default

test/conformance/chainsaw/validate/clusterpolicy/cornercases/external-metrics/cluster-policy-ready.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-    name: external-metrics-policy
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/external-metrics/cluster-policy.yaml

@@ -1,30 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-    name: external-metrics-policy
-spec:
-  background: false
-  rules:
-  - name: external-metrics-rule
-    match:
-      all:
-      - clusterRoles:
-        - evil-cr
-        resources:
-          kinds:
-          - Secret
-    validate:
-      failureAction: Enforce
-      message: 'You should be careful when trying to change/delete {{request.oldObject.kind}} in {{request.oldObject.name}}. These are my-precious resources and touching them might break my heart.'
-      deny:
-        conditions:
-          any:
-          - key: '{{request.operation}}'
-            operator: Equals
-            value: DELETE
-          - key: '{{request.operation}}'
-            operator: Equals
-            value: UPDATE
-          - key: '{{request.operation}}'
-            operator: Equals
-            value: CREATE

test/conformance/chainsaw/validate/clusterpolicy/cornercases/external-metrics/policy-ready.yaml

@@ -1,10 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: Policy
-metadata:
-    name: external-metrics-policy-default
-    namespace: default
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/external-metrics/policy.yaml

@@ -1,4 +1,35 @@
 apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+    name: external-metrics-policy
+spec:
+  background: false
+  rules:
+  - name: external-metrics-rule
+    match:
+      all:
+      - clusterRoles:
+        - evil-cr
+        resources:
+          kinds:
+          - Secret
+    validate:
+      failureAction: Enforce
+      message: 'You should be careful when trying to change/delete {{request.oldObject.kind}} in {{request.oldObject.name}}. These are my-precious resources and touching them might break my heart.'
+      deny:
+        conditions:
+          any:
+          - key: '{{request.operation}}'
+            operator: Equals
+            value: DELETE
+          - key: '{{request.operation}}'
+            operator: Equals
+            value: UPDATE
+          - key: '{{request.operation}}'
+            operator: Equals
+            value: CREATE
+---
+apiVersion: kyverno.io/v1
 kind: Policy
 metadata:
     name: external-metrics-policy-default
@@ -28,4 +59,4 @@ spec:
             value: UPDATE
           - key: '{{request.operation}}'
             operator: Equals
-            value: CREATE
+            value: CREATE

test/conformance/chainsaw/validate/clusterpolicy/cornercases/invalid-jmespath-variable-substitution-deprecated/chainsaw-test.yaml

@@ -4,12 +4,20 @@ metadata:
   name: variable-substitution-failure-messages
 spec:
   steps:
-  - name: step-01 
+  - name: create policy
-    try: 
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml    
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: test-panic
   - name: step-02  
     try:  
     - script:  

test/conformance/chainsaw/validate/clusterpolicy/cornercases/invalid-jmespath-variable-substitution-deprecated/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: test-panic
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/invalid-jmespath-variable-substitution/chainsaw-test.yaml

@@ -4,12 +4,20 @@ metadata:
   name: variable-substitution-failure-messages
 spec:
   steps:
-  - name: step-01 
+  - name: create policy
-    try: 
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml    
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: test-panic
   - name: step-02  
     try:  
     - script:  

test/conformance/chainsaw/validate/clusterpolicy/cornercases/invalid-jmespath-variable-substitution/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: test-panic
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/psa-run-as-non-root/chainsaw-test.yaml

@@ -4,12 +4,20 @@ metadata:
   name: psa-run-as-non-root
 spec:
   steps:
-  - name: step-01
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: psp-restricted-limited
   - name: step-02
     try:
     - script:

test/conformance/chainsaw/validate/clusterpolicy/cornercases/psa-run-as-non-root/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: psp-restricted-limited
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/schema-validation-for-mutateExisting-deprecated/chainsaw-test.yaml

@@ -8,9 +8,17 @@ spec:
     try:
     - apply:
         file: chainsaw-step-00-apply-1-1.yaml
-  - name: step-01
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: generate-cm-for-kube-state-metrics-crds

test/conformance/chainsaw/validate/clusterpolicy/cornercases/schema-validation-for-mutateExisting-deprecated/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: generate-cm-for-kube-state-metrics-crds
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/schema-validation-for-mutateExisting/chainsaw-test.yaml

@@ -8,9 +8,17 @@ spec:
     try:
     - apply:
         file: chainsaw-step-00-apply-1-1.yaml
-  - name: step-01
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: generate-cm-for-kube-state-metrics-crds

test/conformance/chainsaw/validate/clusterpolicy/cornercases/schema-validation-for-mutateExisting/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: generate-cm-for-kube-state-metrics-crds
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/two-rules-with-different-action/chainsaw-test.yaml

@@ -4,30 +4,38 @@ metadata:
   name: two-rules-with-different-action
 spec:
   steps:
-    - name: step-01
+  - name: step-01
-      try:
+    try:
-      - script:
+    - script:
-          content: kubectl patch configmap kyverno -p '{"data":{"generateSuccessEvents":"true"}}' -n kyverno
+        content: kubectl patch configmap kyverno -p '{"data":{"generateSuccessEvents":"true"}}' -n kyverno
-      - assert:
+    - assert:
-          file: kyverno-configmap-assert.yaml
+        file: kyverno-configmap-assert.yaml
-    - name: step-02
+  - name: create policy
-      try:
+    use:
-        - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-            file: policy.yaml
+      with:
-        - assert:
+        bindings:
-            file: policy-assert.yaml
+        - name: file
-    - name: step-03
+          value: policy.yaml
-      try:
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: check-ns-labels
+  - name: step-03
+    try:
+    - apply:
+        file: good-resources.yaml
+  - name: step-04
+    try:
       - apply:
-          file: good-resources.yaml
+          expect:
-    - name: step-04
+            - check:
-      try:
+                ($error != null): true
-        - apply:
+          file: bad-resources.yaml
-            expect:
+  - name: step-05
-              - check:
+    try:
-                  ($error != null): true
+    - assert:
-            file: bad-resources.yaml
+        file: events-assert.yaml
-    - name: step-05
-      try:
-      - assert:
-          file: events-assert.yaml

test/conformance/chainsaw/validate/clusterpolicy/cornercases/two-rules-with-different-action/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: check-ns-labels
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/validate-pattern-should-fail-deprecated/chainsaw-test.yaml

@@ -4,20 +4,28 @@ metadata:
   name: validate-pattern-should-fail
 spec:
   steps:
-    - name: step-01
+  - name: create policy
-      try:
+    use:
-        - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-            file: policy.yaml
+      with:
-        - assert:
+        bindings:
-            file: policy-assert.yaml
+        - name: file
-    - name: step-02
+          value: policy.yaml
-      try:
+  - name: wait policy ready
-        - apply:
+    use:
-            expect:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
-              - check:
+      with:
-                  ($error != null): true
+        bindings:
-            file: resource.yaml
+        - name: name
-    - name: step-03
+          value: priv
-      try:
+  - name: step-02
-        - assert:
+    try:
-            file: event-assert.yaml
+      - apply:
+          expect:
+            - check:
+                ($error != null): true
+          file: resource.yaml
+  - name: step-03
+    try:
+      - assert:
+          file: event-assert.yaml

test/conformance/chainsaw/validate/clusterpolicy/cornercases/validate-pattern-should-fail-deprecated/policy-assert.yaml

@@ -1,10 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: priv
-spec: {}
-status:
-  conditions:
-    - reason: Succeeded
-      status: "True"
-      type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/validate-pattern-should-fail/chainsaw-test.yaml

@@ -4,20 +4,28 @@ metadata:
   name: validate-pattern-should-fail
 spec:
   steps:
-    - name: step-01
+  - name: create policy
-      try:
+    use:
-        - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-            file: policy.yaml
+      with:
-        - assert:
+        bindings:
-            file: policy-assert.yaml
+        - name: file
-    - name: step-02
+          value: policy.yaml
-      try:
+  - name: wait policy ready
-        - apply:
+    use:
-            expect:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
-              - check:
+      with:
-                  ($error != null): true
+        bindings:
-            file: resource.yaml
+        - name: name
-    - name: step-03
+          value: priv
-      try:
+  - name: step-02
-        - assert:
+    try:
-            file: event-assert.yaml
+      - apply:
+          expect:
+            - check:
+                ($error != null): true
+          file: resource.yaml
+  - name: step-03
+    try:
+      - assert:
+          file: event-assert.yaml

test/conformance/chainsaw/validate/clusterpolicy/cornercases/validate-pattern-should-fail/policy-assert.yaml

@@ -1,10 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: priv
-spec: {}
-status:
-  conditions:
-    - reason: Succeeded
-      status: "True"
-      type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/validate-pattern-should-pass-deprecated/chainsaw-test.yaml

@@ -4,27 +4,35 @@ metadata:
   name: validate-pattern-should-pass
 spec:
   steps:
-    - name: step-01
+  - name: step-01
-      try:
+    try:
-      - script:
+    - script:
-          content: kubectl patch configmap kyverno -p '{"data":{"generateSuccessEvents":"true"}}' -n kyverno
+        content: kubectl patch configmap kyverno -p '{"data":{"generateSuccessEvents":"true"}}' -n kyverno
+    - assert:
+        file: kyverno-configmap-assert.yaml
+  - name: create policy
+    use:
+      template: ../../../../_step-templates/create-policy.yaml
+      with:
+        bindings:
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: priv
+  - name: step-03
+    try:
+      - apply:
+          file: resource.yaml
+  - name: step-04
+    try:
       - assert:
-          file: kyverno-configmap-assert.yaml
+          file: event-assert.yaml
-    - name: step-02
+  - name: step-05
-      try:
+    try:
-        - apply:
+      - assert:
-            file: policy.yaml
+          file: report-pass-assert.yaml
-        - assert:
-            file: policy-assert.yaml
-    - name: step-03
-      try:
-        - apply:
-            file: resource.yaml
-    - name: step-04
-      try:
-        - assert:
-            file: event-assert.yaml
-    - name: step-05
-      try:
-        - assert:
-            file: report-pass-assert.yaml

test/conformance/chainsaw/validate/clusterpolicy/cornercases/validate-pattern-should-pass-deprecated/policy-assert.yaml

@@ -1,10 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: priv
-spec: {}
-status:
-  conditions:
-    - reason: Succeeded
-      status: "True"
-      type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/validate-pattern-should-pass/chainsaw-test.yaml

@@ -4,27 +4,35 @@ metadata:
   name: validate-pattern-should-pass
 spec:
   steps:
-    - name: step-01
+  - name: step-01
-      try:
+    try:
-      - script:
+    - script:
-          content: kubectl patch configmap kyverno -p '{"data":{"generateSuccessEvents":"true"}}' -n kyverno
+        content: kubectl patch configmap kyverno -p '{"data":{"generateSuccessEvents":"true"}}' -n kyverno
+    - assert:
+        file: kyverno-configmap-assert.yaml
+  - name: create policy
+    use:
+      template: ../../../../_step-templates/create-policy.yaml
+      with:
+        bindings:
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: priv
+  - name: step-03
+    try:
+      - apply:
+          file: resource.yaml
+  - name: step-04
+    try:
       - assert:
-          file: kyverno-configmap-assert.yaml
+          file: event-assert.yaml
-    - name: step-02
+  - name: step-05
-      try:
+    try:
-        - apply:
+      - assert:
-            file: policy.yaml
+          file: report-pass-assert.yaml
-        - assert:
-            file: policy-assert.yaml
-    - name: step-03
-      try:
-        - apply:
-            file: resource.yaml
-    - name: step-04
-      try:
-        - assert:
-            file: event-assert.yaml
-    - name: step-05
-      try:
-        - assert:
-            file: report-pass-assert.yaml

test/conformance/chainsaw/validate/clusterpolicy/cornercases/validate-pattern-should-pass/policy-assert.yaml

@@ -1,10 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: priv
-spec: {}
-status:
-  conditions:
-    - reason: Succeeded
-      status: "True"
-      type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/validate-pattern-should-skip-deprecated/chainsaw-test.yaml

@@ -4,17 +4,25 @@ metadata:
   name: validate-pattern-should-skip
 spec:
   steps:
-    - name: step-01
+  - name: create policy
-      try:
+    use:
-        - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-            file: policy.yaml
+      with:
-        - assert:
+        bindings:
-            file: policy-assert.yaml
+        - name: file
-    - name: step-02
+          value: policy.yaml
-      try:
+  - name: wait policy ready
-        - apply:
+    use:
-            file: resource.yaml
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
-    - name: step-03
+      with:
-      try:
+        bindings:
-        - assert:
+        - name: name
-            file: report-skip-assert.yaml
+          value: priv
+  - name: step-02
+    try:
+      - apply:
+          file: resource.yaml
+  - name: step-03
+    try:
+      - assert:
+          file: report-skip-assert.yaml

test/conformance/chainsaw/validate/clusterpolicy/cornercases/validate-pattern-should-skip-deprecated/policy-assert.yaml

@@ -1,10 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: priv
-spec: {}
-status:
-  conditions:
-    - reason: Succeeded
-      status: "True"
-      type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/validate-pattern-should-skip/chainsaw-test.yaml

@@ -4,17 +4,25 @@ metadata:
   name: validate-pattern-should-skip
 spec:
   steps:
-    - name: step-01
+  - name: create policy
-      try:
+    use:
-        - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-            file: policy.yaml
+      with:
-        - assert:
+        bindings:
-            file: policy-assert.yaml
+        - name: file
-    - name: step-02
+          value: policy.yaml
-      try:
+  - name: wait policy ready
-        - apply:
+    use:
-            file: resource.yaml
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
-    - name: step-03
+      with:
-      try:
+        bindings:
-        - assert:
+        - name: name
-            file: report-skip-assert.yaml
+          value: priv
+  - name: step-02
+    try:
+      - apply:
+          file: resource.yaml
+  - name: step-03
+    try:
+      - assert:
+          file: report-skip-assert.yaml

test/conformance/chainsaw/validate/clusterpolicy/cornercases/validate-pattern-should-skip/policy-assert.yaml

@@ -1,10 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: priv
-spec: {}
-status:
-  conditions:
-    - reason: Succeeded
-      status: "True"
-      type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/variable-substitution-failure-messages-deprecated/chainsaw-test.yaml

@@ -4,12 +4,20 @@ metadata:
   name: variable-substitution-failure-messages
 spec:
   steps:
-  - name: step-01 
+  - name: create policy
-    try: 
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml    
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: uid-groups-fsgroup-validate
   - name: step-02  
     try:  
     - script:  

test/conformance/chainsaw/validate/clusterpolicy/cornercases/variable-substitution-failure-messages-deprecated/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: uid-groups-fsgroup-validate
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/cornercases/variable-substitution-failure-messages/chainsaw-test.yaml

@@ -4,12 +4,20 @@ metadata:
   name: variable-substitution-failure-messages
 spec:
   steps:
-  - name: step-01 
+  - name: create policy
-    try: 
+    use:
-    - apply:
+      template: ../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml    
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: uid-groups-fsgroup-validate
   - name: step-02  
     try:  
     - script:  

test/conformance/chainsaw/validate/clusterpolicy/cornercases/variable-substitution-failure-messages/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: uid-groups-fsgroup-validate
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/apicalls-deprecated/lazyload/chainsaw-step-01-assert-1-1.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: ingress-unique-host
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/apicalls-deprecated/lazyload/chainsaw-test.yaml

@@ -4,16 +4,26 @@ metadata:
   name: lazyload
 spec:
   steps:
+  - name: create policy
+    use:
+      template: ../../../../../_step-templates/create-policy.yaml
+      with:
+        bindings:
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: ingress-unique-host
   - name: step-01
     try:
-    - apply:
-        file: chainsaw-step-01-apply-1-1.yaml
     - apply:
         file: chainsaw-step-01-apply-1-2.yaml
     - apply:
         file: chainsaw-step-01-apply-1-3.yaml
-    - assert:
-        file: chainsaw-step-01-assert-1-1.yaml
     - assert:
         file: chainsaw-step-01-assert-1-2.yaml
   - name: step-02

test/conformance/chainsaw/validate/clusterpolicy/standard/apicalls-deprecated/subjectaccessreview/chainsaw-step-01-assert-1-1.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: check-subjectaccessreview
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/apicalls-deprecated/subjectaccessreview/chainsaw-test.yaml

@@ -12,10 +12,20 @@ spec:
         file: chainsaw-step-01-apply-1-2.yaml
     - apply:
         file: chainsaw-step-01-apply-1-3.yaml
-    - apply:
+  - name: create policy
-        file: chainsaw-step-01-apply-1-4.yaml
+    use:
-    - assert:
+      template: ../../../../../_step-templates/create-policy.yaml
-        file: chainsaw-step-01-assert-1-1.yaml
+      with:
+        bindings:
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: check-subjectaccessreview
   - name: step-02
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/standard/apicalls/default/chainsaw-test.yaml

@@ -8,12 +8,20 @@ spec:
     try:
     - apply:
         file: ns-bad.yaml
-  - name: step-02
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: default
   - name: step-03
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/standard/apicalls/lazyload/chainsaw-step-01-assert-1-1.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: ingress-unique-host
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/apicalls/lazyload/chainsaw-test.yaml

@@ -4,16 +4,26 @@ metadata:
   name: lazyload
 spec:
   steps:
+  - name: create policy
+    use:
+      template: ../../../../../_step-templates/create-policy.yaml
+      with:
+        bindings:
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: ingress-unique-host
   - name: step-01
     try:
-    - apply:
-        file: chainsaw-step-01-apply-1-1.yaml
     - apply:
         file: chainsaw-step-01-apply-1-2.yaml
     - apply:
         file: chainsaw-step-01-apply-1-3.yaml
-    - assert:
-        file: chainsaw-step-01-assert-1-1.yaml
     - assert:
         file: chainsaw-step-01-assert-1-2.yaml
   - name: step-02

test/conformance/chainsaw/validate/clusterpolicy/standard/apicalls/subjectaccessreview/chainsaw-step-01-assert-1-1.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: check-subjectaccessreview
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/apicalls/subjectaccessreview/chainsaw-test.yaml

@@ -12,10 +12,20 @@ spec:
         file: chainsaw-step-01-apply-1-2.yaml
     - apply:
         file: chainsaw-step-01-apply-1-3.yaml
-    - apply:
+  - name: create policy
-        file: chainsaw-step-01-apply-1-4.yaml
+    use:
-    - assert:
+      template: ../../../../../_step-templates/create-policy.yaml
-        file: chainsaw-step-01-assert-1-1.yaml
+      with:
+        bindings:
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: check-subjectaccessreview
   - name: step-02
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/standard/audit-deprecated/configmap-context-lookup/chainsaw-step-01-assert-1-1.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: validate-labels
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/audit-deprecated/configmap-context-lookup/chainsaw-test.yaml

@@ -10,10 +10,20 @@ spec:
         file: chainsaw-step-01-apply-1-1.yaml
     - apply:
         file: chainsaw-step-01-apply-1-2.yaml
-    - apply:
+  - name: create policy
-        file: chainsaw-step-01-apply-1-3.yaml
+    use:
-    - assert:
+      template: ../../../../../_step-templates/create-policy.yaml
-        file: chainsaw-step-01-assert-1-1.yaml
+      with:
+        bindings:
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: validate-labels
   - name: step-02
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/standard/audit/configmap-context-lookup/chainsaw-step-01-assert-1-1.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: validate-labels
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/audit/configmap-context-lookup/chainsaw-test.yaml

@@ -10,10 +10,20 @@ spec:
         file: chainsaw-step-01-apply-1-1.yaml
     - apply:
         file: chainsaw-step-01-apply-1-2.yaml
-    - apply:
+  - name: create policy
-        file: chainsaw-step-01-apply-1-3.yaml
+    use:
-    - assert:
+      template: ../../../../../_step-templates/create-policy.yaml
-        file: chainsaw-step-01-assert-1-1.yaml
+      with:
+        bindings:
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: validate-labels
   - name: step-02
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/cel-preconditions/chainsaw-test.yaml

@@ -4,12 +4,20 @@ metadata:
   name: cel-preconditions
 spec:
   steps:
-  - name: step-01
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: disallow-host-port-range
   - name: step-02
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/cel-preconditions/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: disallow-host-port-range
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/cel-variables/chainsaw-test.yaml

@@ -10,12 +10,20 @@ spec:
         file: ns.yaml
     - assert:
         file: ns.yaml
-  - name: step-02
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: image-matches-namespace-environment.policy.example.com
   - name: step-03
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/cel-variables/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: image-matches-namespace-environment.policy.example.com
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/check-statefulset-namespace/chainsaw-test.yaml

@@ -10,12 +10,20 @@ spec:
         file: ns.yaml
     - assert:
         file: ns.yaml
-  - name: step-02
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: check-statefulset-namespace
   - name: step-03
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/check-statefulset-namespace/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: check-statefulset-namespace
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/disallow-host-port/chainsaw-test.yaml

@@ -4,12 +4,20 @@ metadata:
   name: disallow-host-port
 spec:
   steps:
-  - name: step-01
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: disallow-host-port
   - name: step-02
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/disallow-host-port/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: disallow-host-port
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/parameter-resources/clusterscoped/chainsaw-test.yaml

@@ -18,12 +18,20 @@ spec:
         file: namespaceConstraint.yaml
     - assert:
         file: namespaceConstraint.yaml
-  - name: step-03
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: check-namespace-name-01
   - name: step-04
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/parameter-resources/clusterscoped/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: check-namespace-name-01
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/parameter-resources/namespaced/match-clusterscoped-resource/chainsaw-test.yaml

@@ -16,12 +16,20 @@ spec:
         file: nameConstraint.yaml
     - assert:
         file: nameConstraint.yaml
-  - name: step-03
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: check-namespace-name-02
   - name: step-04
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/parameter-resources/namespaced/match-clusterscoped-resource/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: check-namespace-name-02
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/parameter-resources/namespaced/set-paramref-namespace/chainsaw-test.yaml

@@ -24,12 +24,20 @@ spec:
         file: replicaLimit.yaml
     - assert:
         file: replicaLimit.yaml
-  - name: step-04
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: check-deployment-replicas-01
   - name: step-05
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/parameter-resources/namespaced/set-paramref-namespace/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: check-deployment-replicas-01
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/parameter-resources/namespaced/unset-paramref-namespace/chainsaw-test.yaml

@@ -24,12 +24,20 @@ spec:
         file: replicaLimit.yaml
     - assert:
         file: replicaLimit.yaml
-  - name: step-04
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: check-statefulset-replicas
   - name: step-05
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/standard/cel-deprecated/parameter-resources/namespaced/unset-paramref-namespace/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: check-statefulset-replicas
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/cel/cel-preconditions/chainsaw-test.yaml

@@ -4,12 +4,20 @@ metadata:
   name: cel-preconditions
 spec:
   steps:
-  - name: step-01
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: disallow-host-port-range
   - name: step-02
     try:
     - apply:

test/conformance/chainsaw/validate/clusterpolicy/standard/cel/cel-preconditions/policy-assert.yaml

@@ -1,9 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: disallow-host-port-range
-status:
-  conditions:
-  - reason: Succeeded
-    status: "True"
-    type: Ready

test/conformance/chainsaw/validate/clusterpolicy/standard/cel/cel-variables/chainsaw-test.yaml

@@ -10,12 +10,20 @@ spec:
         file: ns.yaml
     - assert:
         file: ns.yaml
-  - name: step-02
+  - name: create policy
-    try:
+    use:
-    - apply:
+      template: ../../../../../_step-templates/create-policy.yaml
-        file: policy.yaml
+      with:
-    - assert:
+        bindings:
-        file: policy-assert.yaml
+        - name: file
+          value: policy.yaml
+  - name: wait policy ready
+    use:
+      template: ../../../../../_step-templates/cluster-policy-ready.yaml
+      with:
+        bindings:
+        - name: name
+          value: image-matches-namespace-environment.policy.example.com
   - name: step-03
     try:
     - apply: