mirror of
https://github.com/kyverno/kyverno.git
synced 2024-12-14 11:57:48 +00:00
chore: use more chainsaw step templates (#11311)
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
parent
decb7524eb
commit
df267dd829
122 changed files with 868 additions and 978 deletions
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: allows-rejects-creation
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: require-labels
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: require-labels
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: applies-to-delete
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psa
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psa
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,10 +4,20 @@ metadata:
|
|||
name: conditions
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: max-containers
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: events-creation
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-latest-tag-events-creation
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-latest-tag-events-creation
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: exclude-capabilities
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psa-1
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psa-1
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: exclude-ephemeral-containers
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: require-run-as-nonroot
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: require-run-as-nonroot
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: exclude-host-ports
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psa-3
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psa-3
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: exclude-host-process-and-host-namespaces
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psa-2
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psa-2
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: exclude-hostpath-volume
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psa
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psa
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: exclude-privilege-escalation
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psa
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psa
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: exclude-privileged-containers
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psa
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psa
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: exclude-restricted-capabilities
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psa
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psa
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: exclude-restricted-seccomp
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psa
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psa
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: exclude-running-as-nonroot-user
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psa
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psa
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: exclude-running-as-nonroot
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psa
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psa
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: exclude-seccomp
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psa
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psa
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: exclude-selinux
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psa
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psa
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: exclude-sysctls
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psa
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psa
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: exclude-volume-types
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psa
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psa
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,10 +4,20 @@ metadata:
|
|||
name: conditions
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: max-containers
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: multiple-exceptions-with-pod-security
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psp-baseline
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psp-baseline
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: multiple-exceptions
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psp-baseline
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psp-baseline
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: only-for-specific-user
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: require-labels
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: require-labels
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: psa-run-as-non-root
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: psp-restricted-limited
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: psp-restricted-limited
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: with-wildcard
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: require-labels
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: require-labels
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: block-ephemeral-containers
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: block-ephemeral-containers
|
||||
- name: step-02
|
||||
try:
|
||||
- assert:
|
||||
|
|
|
@ -1,9 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: block-ephemeral-containers
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
|
@ -12,12 +12,20 @@ spec:
|
|||
try:
|
||||
- script:
|
||||
content: kubectl run my-pod --image nginx -n pci
|
||||
- name: step-03
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: deny-exec-by-namespace-name
|
||||
- name: step-04
|
||||
try:
|
||||
- assert:
|
||||
|
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: deny-exec-by-namespace-name
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-all-match-resource
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path-t9
|
||||
- name: step-02
|
||||
try:
|
||||
- assert:
|
||||
|
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path-t9
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-any-exclude-namespace-match-resource
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path-t16
|
||||
- name: step-02
|
||||
try:
|
||||
- assert:
|
||||
|
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path-t16
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-any-exclude-resource-match-with-namespace-selector
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path-t14
|
||||
- name: step-02
|
||||
try:
|
||||
- assert:
|
||||
|
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path-t14
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-any-exclude-resource-match-with-object-selector
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path-t15
|
||||
- name: step-02
|
||||
try:
|
||||
- assert:
|
||||
|
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path-t15
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-any-exclude-resource
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path-t13
|
||||
- name: step-02
|
||||
try:
|
||||
- assert:
|
||||
|
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path-t13
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-any-match-multiple-resources
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path-t8
|
||||
- name: step-02
|
||||
try:
|
||||
- assert:
|
||||
|
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path-t8
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-any-match-resource
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path-t7
|
||||
- name: step-02
|
||||
try:
|
||||
- assert:
|
||||
|
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path-t7
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-any-match-resources-by-names
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: check-label-app-4
|
||||
- name: step-02
|
||||
try:
|
||||
- assert:
|
||||
|
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: check-label-app-4
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-match-all-exclude-one
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: check-label-app5
|
||||
- name: step-02
|
||||
try:
|
||||
- assert:
|
||||
|
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: check-label-app5
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-match-kind-with-wildcard
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: check-label-app4
|
||||
- name: step-02
|
||||
try:
|
||||
- assert:
|
||||
|
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: check-label-app4
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-match-resource-in-specific-namespace
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path-t4
|
||||
- name: step-02
|
||||
try:
|
||||
- assert:
|
||||
|
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path-t4
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-with-an-exception-excluding-namespaces
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-with-an-exception
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-with-two-exceptions
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path
|
||||
- name: step-02
|
||||
try:
|
||||
- apply:
|
||||
|
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-any-match-multiple-resources-with-namespace-selector
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path-t12
|
||||
- name: step-02
|
||||
try:
|
||||
- error:
|
||||
|
|
|
@ -1,12 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path-t12
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
validatingadmissionpolicy:
|
||||
generated: false
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-any-match-multiple-resources-with-object-selector
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path-t13
|
||||
- name: step-02
|
||||
try:
|
||||
- error:
|
||||
|
|
|
@ -1,12 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path-t13
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
validatingadmissionpolicy:
|
||||
generated: false
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-any-match-resources-by-names-with-wildcard
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: check-label-app-3
|
||||
- name: step-02
|
||||
try:
|
||||
- error:
|
||||
|
|
|
@ -1,12 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: check-label-app-3
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
validatingadmissionpolicy:
|
||||
generated: false
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-any-match-resources-in-namespaces-with-wildcard
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: check-label-app-5
|
||||
- name: step-02
|
||||
try:
|
||||
- error:
|
||||
|
|
|
@ -1,12 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: check-label-app-5
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
validatingadmissionpolicy:
|
||||
generated: false
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-any-match-resources-with-different-namespace-selectors
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path-t1
|
||||
- name: step-02
|
||||
try:
|
||||
- error:
|
||||
|
|
|
@ -1,12 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path-t1
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
validatingadmissionpolicy:
|
||||
generated: false
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-any-match-resources-with-different-object-selectors
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path-t2
|
||||
- name: step-02
|
||||
try:
|
||||
- error:
|
||||
|
|
|
@ -1,12 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path-t2
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
validatingadmissionpolicy:
|
||||
generated: false
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-exclude-resources-in-specific-namespace
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path-t17
|
||||
- name: step-02
|
||||
try:
|
||||
- error:
|
||||
|
|
|
@ -1,12 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path-t17
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
validatingadmissionpolicy:
|
||||
generated: false
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-exclude-resources-with-namespace-selector
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: disallow-host-path-t10
|
||||
- name: step-02
|
||||
try:
|
||||
- error:
|
||||
|
|
|
@ -1,12 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-path-t10
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
validatingadmissionpolicy:
|
||||
generated: false
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-exclude-resources-with-object-selector
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: check-label-app2
|
||||
- name: step-02
|
||||
try:
|
||||
- error:
|
||||
|
|
|
@ -1,12 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: check-label-app2
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
validatingadmissionpolicy:
|
||||
generated: false
|
||||
|
|
@ -4,12 +4,20 @@ metadata:
|
|||
name: cpol-exclude-user-and-roles
|
||||
spec:
|
||||
steps:
|
||||
- name: step-01
|
||||
try:
|
||||
- apply:
|
||||
file: policy.yaml
|
||||
- assert:
|
||||
file: policy-assert.yaml
|
||||
- name: create policy
|
||||
use:
|
||||
template: ../../../../../_step-templates/create-policy.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: file
|
||||
value: policy.yaml
|
||||
- name: wait policy ready
|
||||
use:
|
||||
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||
with:
|
||||
bindings:
|
||||
- name: name
|
||||
value: check-label-app1
|
||||
- name: step-02
|
||||
try:
|
||||
- error:
|
||||
|
|
|
@ -1,12 +0,0 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: check-label-app1
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
validatingadmissionpolicy:
|
||||
generated: false
|
||||
|
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue