mirror of
https://github.com/kyverno/kyverno.git
synced 2024-12-14 11:57:48 +00:00
chore: use more chainsaw step templates (#11311)
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
parent
decb7524eb
commit
df267dd829
122 changed files with 868 additions and 978 deletions
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: allows-rejects-creation
|
name: allows-rejects-creation
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: require-labels
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: require-labels
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: applies-to-delete
|
name: applies-to-delete
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psa
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psa
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,10 +4,20 @@ metadata:
|
||||||
name: conditions
|
name: conditions
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: max-containers
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: events-creation
|
name: events-creation
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-latest-tag-events-creation
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-latest-tag-events-creation
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: exclude-capabilities
|
name: exclude-capabilities
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psa-1
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psa-1
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: exclude-ephemeral-containers
|
name: exclude-ephemeral-containers
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: require-run-as-nonroot
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: require-run-as-nonroot
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: exclude-host-ports
|
name: exclude-host-ports
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psa-3
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psa-3
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: exclude-host-process-and-host-namespaces
|
name: exclude-host-process-and-host-namespaces
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psa-2
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psa-2
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: exclude-hostpath-volume
|
name: exclude-hostpath-volume
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psa
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psa
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: exclude-privilege-escalation
|
name: exclude-privilege-escalation
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psa
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psa
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: exclude-privileged-containers
|
name: exclude-privileged-containers
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psa
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psa
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: exclude-restricted-capabilities
|
name: exclude-restricted-capabilities
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psa
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psa
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: exclude-restricted-seccomp
|
name: exclude-restricted-seccomp
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psa
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psa
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: exclude-running-as-nonroot-user
|
name: exclude-running-as-nonroot-user
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psa
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psa
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: exclude-running-as-nonroot
|
name: exclude-running-as-nonroot
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psa
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psa
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: exclude-seccomp
|
name: exclude-seccomp
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psa
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psa
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: exclude-selinux
|
name: exclude-selinux
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psa
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psa
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: exclude-sysctls
|
name: exclude-sysctls
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psa
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psa
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: exclude-volume-types
|
name: exclude-volume-types
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psa
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psa
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,10 +4,20 @@ metadata:
|
||||||
name: conditions
|
name: conditions
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: max-containers
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: multiple-exceptions-with-pod-security
|
name: multiple-exceptions-with-pod-security
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psp-baseline
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psp-baseline
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: multiple-exceptions
|
name: multiple-exceptions
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psp-baseline
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psp-baseline
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: only-for-specific-user
|
name: only-for-specific-user
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: require-labels
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: require-labels
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: psa-run-as-non-root
|
name: psa-run-as-non-root
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: psp-restricted-limited
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: psp-restricted-limited
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: with-wildcard
|
name: with-wildcard
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: require-labels
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: require-labels
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: block-ephemeral-containers
|
name: block-ephemeral-containers
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: block-ephemeral-containers
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- assert:
|
- assert:
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: block-ephemeral-containers
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
|
@ -12,12 +12,20 @@ spec:
|
||||||
try:
|
try:
|
||||||
- script:
|
- script:
|
||||||
content: kubectl run my-pod --image nginx -n pci
|
content: kubectl run my-pod --image nginx -n pci
|
||||||
- name: step-03
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: deny-exec-by-namespace-name
|
||||||
- name: step-04
|
- name: step-04
|
||||||
try:
|
try:
|
||||||
- assert:
|
- assert:
|
||||||
|
|
|
@ -1,10 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: deny-exec-by-namespace-name
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-all-match-resource
|
name: cpol-all-match-resource
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path-t9
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- assert:
|
- assert:
|
||||||
|
|
|
@ -1,10 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path-t9
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-any-exclude-namespace-match-resource
|
name: cpol-any-exclude-namespace-match-resource
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path-t16
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- assert:
|
- assert:
|
||||||
|
|
|
@ -1,10 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path-t16
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-any-exclude-resource-match-with-namespace-selector
|
name: cpol-any-exclude-resource-match-with-namespace-selector
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path-t14
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- assert:
|
- assert:
|
||||||
|
|
|
@ -1,10 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path-t14
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-any-exclude-resource-match-with-object-selector
|
name: cpol-any-exclude-resource-match-with-object-selector
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path-t15
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- assert:
|
- assert:
|
||||||
|
|
|
@ -1,10 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path-t15
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-any-exclude-resource
|
name: cpol-any-exclude-resource
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path-t13
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- assert:
|
- assert:
|
||||||
|
|
|
@ -1,10 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path-t13
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-any-match-multiple-resources
|
name: cpol-any-match-multiple-resources
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path-t8
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- assert:
|
- assert:
|
||||||
|
|
|
@ -1,10 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path-t8
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-any-match-resource
|
name: cpol-any-match-resource
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path-t7
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- assert:
|
- assert:
|
||||||
|
|
|
@ -1,10 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path-t7
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-any-match-resources-by-names
|
name: cpol-any-match-resources-by-names
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: check-label-app-4
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- assert:
|
- assert:
|
||||||
|
|
|
@ -1,10 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: check-label-app-4
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-match-all-exclude-one
|
name: cpol-match-all-exclude-one
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: check-label-app5
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- assert:
|
- assert:
|
||||||
|
|
|
@ -1,10 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: check-label-app5
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-match-kind-with-wildcard
|
name: cpol-match-kind-with-wildcard
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: check-label-app4
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- assert:
|
- assert:
|
||||||
|
|
|
@ -1,10 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: check-label-app4
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-match-resource-in-specific-namespace
|
name: cpol-match-resource-in-specific-namespace
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path-t4
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- assert:
|
- assert:
|
||||||
|
|
|
@ -1,10 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path-t4
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-with-an-exception-excluding-namespaces
|
name: cpol-with-an-exception-excluding-namespaces
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,10 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-with-an-exception
|
name: cpol-with-an-exception
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,10 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-with-two-exceptions
|
name: cpol-with-two-exceptions
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
|
|
|
@ -1,10 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-any-match-multiple-resources-with-namespace-selector
|
name: cpol-any-match-multiple-resources-with-namespace-selector
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path-t12
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- error:
|
- error:
|
||||||
|
|
|
@ -1,12 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path-t12
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
validatingadmissionpolicy:
|
|
||||||
generated: false
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-any-match-multiple-resources-with-object-selector
|
name: cpol-any-match-multiple-resources-with-object-selector
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path-t13
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- error:
|
- error:
|
||||||
|
|
|
@ -1,12 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path-t13
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
validatingadmissionpolicy:
|
|
||||||
generated: false
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-any-match-resources-by-names-with-wildcard
|
name: cpol-any-match-resources-by-names-with-wildcard
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: check-label-app-3
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- error:
|
- error:
|
||||||
|
|
|
@ -1,12 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: check-label-app-3
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
validatingadmissionpolicy:
|
|
||||||
generated: false
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-any-match-resources-in-namespaces-with-wildcard
|
name: cpol-any-match-resources-in-namespaces-with-wildcard
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: check-label-app-5
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- error:
|
- error:
|
||||||
|
|
|
@ -1,12 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: check-label-app-5
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
validatingadmissionpolicy:
|
|
||||||
generated: false
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-any-match-resources-with-different-namespace-selectors
|
name: cpol-any-match-resources-with-different-namespace-selectors
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path-t1
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- error:
|
- error:
|
||||||
|
|
|
@ -1,12 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path-t1
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
validatingadmissionpolicy:
|
|
||||||
generated: false
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-any-match-resources-with-different-object-selectors
|
name: cpol-any-match-resources-with-different-object-selectors
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path-t2
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- error:
|
- error:
|
||||||
|
|
|
@ -1,12 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path-t2
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
validatingadmissionpolicy:
|
|
||||||
generated: false
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-exclude-resources-in-specific-namespace
|
name: cpol-exclude-resources-in-specific-namespace
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path-t17
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- error:
|
- error:
|
||||||
|
|
|
@ -1,12 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path-t17
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
validatingadmissionpolicy:
|
|
||||||
generated: false
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-exclude-resources-with-namespace-selector
|
name: cpol-exclude-resources-with-namespace-selector
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: disallow-host-path-t10
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- error:
|
- error:
|
||||||
|
|
|
@ -1,12 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: disallow-host-path-t10
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
validatingadmissionpolicy:
|
|
||||||
generated: false
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-exclude-resources-with-object-selector
|
name: cpol-exclude-resources-with-object-selector
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: check-label-app2
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- error:
|
- error:
|
||||||
|
|
|
@ -1,12 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: check-label-app2
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
validatingadmissionpolicy:
|
|
||||||
generated: false
|
|
||||||
|
|
|
@ -4,12 +4,20 @@ metadata:
|
||||||
name: cpol-exclude-user-and-roles
|
name: cpol-exclude-user-and-roles
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: step-01
|
- name: create policy
|
||||||
try:
|
use:
|
||||||
- apply:
|
template: ../../../../../_step-templates/create-policy.yaml
|
||||||
file: policy.yaml
|
with:
|
||||||
- assert:
|
bindings:
|
||||||
file: policy-assert.yaml
|
- name: file
|
||||||
|
value: policy.yaml
|
||||||
|
- name: wait policy ready
|
||||||
|
use:
|
||||||
|
template: ../../../../../_step-templates/cluster-policy-ready.yaml
|
||||||
|
with:
|
||||||
|
bindings:
|
||||||
|
- name: name
|
||||||
|
value: check-label-app1
|
||||||
- name: step-02
|
- name: step-02
|
||||||
try:
|
try:
|
||||||
- error:
|
- error:
|
||||||
|
|
|
@ -1,12 +0,0 @@
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: check-label-app1
|
|
||||||
status:
|
|
||||||
conditions:
|
|
||||||
- reason: Succeeded
|
|
||||||
status: "True"
|
|
||||||
type: Ready
|
|
||||||
validatingadmissionpolicy:
|
|
||||||
generated: false
|
|
||||||
|
|
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue