1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-28 02:18:15 +00:00

chore: use more chainsaw step templates (#11308)

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
Charles-Edouard Brétéché 2024-10-03 12:53:14 +02:00 committed by GitHub
parent 12d5223d56
commit decb7524eb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
52 changed files with 347 additions and 378 deletions

View file

@ -4,12 +4,20 @@ metadata:
name: exception
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: require-labels
- name: step-02
try:
- apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-labels
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: add-labels
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: basic-check-output
spec:
steps:
- name: step-01
try:
- apply:
file: chainsaw-step-01-apply-1-1.yaml
- assert:
file: chainsaw-step-01-assert-1-1.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: add-labels
- name: step-02
try:
- apply:

View file

@ -4,12 +4,20 @@ metadata:
name: namespaceselector
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: test-audit-reports-namespacesselector
- name: step-02
try:
- apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: test-audit-reports-namespacesselector
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: namespaceselector
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: test-audit-reports-namespacesselector
- name: step-02
try:
- apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: test-audit-reports-namespacesselector
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-owner
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: test-report-admission-mode
spec:
steps:
- name: step-01
try:
- apply:
file: chainsaw-step-01-apply-1.yaml
- assert:
file: chainsaw-step-01-assert-1.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: require-owner
- name: step-02
try:
- apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-owner
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: test-report-audit-warn
spec:
steps:
- name: step-01
try:
- apply:
file: chainsaw-step-01-apply-1.yaml
- assert:
file: chainsaw-step-01-assert-1.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: require-owner
- name: step-02
try:
- apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-owner
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: test-report-admission-mode
spec:
steps:
- name: step-01
try:
- apply:
file: chainsaw-step-01-apply-1.yaml
- assert:
file: chainsaw-step-01-assert-1.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: require-owner
- name: step-02
try:
- apply:

View file

@ -4,30 +4,38 @@ metadata:
name: two-rules-with-different-modes
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: step-02
try:
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: check-ns-labels
- name: step-02
try:
- apply:
file: good-resources.yaml
- name: step-03
try:
- apply:
file: good-resources.yaml
- name: step-03
try:
- apply:
expect:
- check:
($error != null): true
file: bad-resources.yaml
- name: step-04
try:
- sleep:
duration: 5s
- name: step-05
try:
- assert:
file: reports-assert.yaml
- error:
file: reports-error.yaml
expect:
- check:
($error != null): true
file: bad-resources.yaml
- name: step-04
try:
- sleep:
duration: 5s
- name: step-05
try:
- assert:
file: reports-assert.yaml
- error:
file: reports-error.yaml

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: check-ns-labels
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -5,12 +5,20 @@ metadata:
name: update-deployment
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: require-multiple-replicas
- name: step-02
try:
- apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-multiple-replicas
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: update
spec:
steps:
- name: step-01
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-latest-tag
- name: step-02
try:
- apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-latest-tag
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -10,12 +10,20 @@ spec:
file: configmap.yaml
- assert:
file: configmap.yaml
- name: step-02
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: require-labels
- name: step-03
try:
- apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-labels
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -14,12 +14,20 @@ spec:
try:
- apply:
file: deployment.yaml
- name: step-03
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: check-deployment-replicas
- name: step-04
try:
- apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: check-deployment-replicas
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -8,12 +8,20 @@ spec:
try:
- apply:
file: pod.yaml
- name: step-02
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa-1
- name: step-03
try:
- apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa-1
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -10,12 +10,20 @@ spec:
file: configmap.yaml
- assert:
file: configmap.yaml
- name: step-02
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: require-labels
- name: step-03
try:
- apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-labels
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v2beta1
kind: ClusterPolicy
metadata:
name: cpol-nosync-clone
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -8,12 +8,23 @@ spec:
try:
- apply:
file: permissions.yaml
- apply:
file: chainsaw-step-01-apply-1-1.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- try:
- apply:
file: chainsaw-step-01-apply-1-2.yaml
- assert:
file: chainsaw-step-01-assert-1-1.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: cpol-nosync-clone
- name: step-02
try:
- apply:

View file

@ -8,12 +8,20 @@ spec:
try:
- apply:
file: pod.yaml
- name: step-02
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psp-baseline
- name: step-03
try:
- apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psp-baseline
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: mutate-existing-secret
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -7,13 +7,23 @@ spec:
- name: step-01
try:
- apply:
file: chainsaw-step-01-apply-1-1.yaml
file: ns.yaml
- apply:
file: chainsaw-step-01-apply-1-2.yaml
- apply:
file: chainsaw-step-01-apply-1-3.yaml
- assert:
file: chainsaw-step-01-assert-1-1.yaml
file: secret.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: mutate-existing-secret
- name: step-02
try:
- apply:

View file

@ -4,12 +4,20 @@ metadata:
name: report-deletion
spec:
steps:
- name: step-00
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: podsecurity-subrule-restricted
- name: step-01
try:
- apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: podsecurity-subrule-restricted
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -10,12 +10,20 @@ spec:
file: pod.yaml
- assert:
file: pod-assert.yaml
- name: step-02
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: podsecurity-subrule-restricted
- name: step-03
try:
- assert:

View file

@ -1,23 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: podsecurity-subrule-restricted
spec:
background: true
rules:
- match:
any:
- resources:
kinds:
- Pod
name: restricted
validate:
failureAction: Audit
podSecurity:
level: restricted
version: latest
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,25 +4,33 @@ metadata:
name: two-rules-with-different-modes
spec:
steps:
- name: step-01
try:
- apply:
file: good-resources.yaml
- name: step-02
try:
- apply:
file: bad-resources.yaml
- name: step-03
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: step-04
try:
- sleep:
duration: 10s
- name: step-05
try:
- assert:
file: reports-assert.yaml
- name: step-01
try:
- apply:
file: good-resources.yaml
- name: step-02
try:
- apply:
file: bad-resources.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: check-ns-labels
- name: step-04
try:
- sleep:
duration: 10s
- name: step-05
try:
- assert:
file: reports-assert.yaml

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: check-ns-labels
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -10,12 +10,20 @@ spec:
file: pod.yaml
- assert:
file: pod-assert.yaml
- name: step-02
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/policy-ready.yaml
with:
bindings:
- name: name
value: keyed-basic-policy
- name: step-03
try:
- assert:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: Policy
metadata:
name: keyed-basic-policy
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -10,12 +10,20 @@ spec:
file: pod.yaml
- assert:
file: pod-assert.yaml
- name: step-02
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: create policy
use:
template: ../../../_step-templates/create-policy.yaml
with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../_step-templates/policy-ready.yaml
with:
bindings:
- name: name
value: keyed-basic-policy
- name: step-03
try:
- assert:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: Policy
metadata:
name: keyed-basic-policy
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready