1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-14 11:57:48 +00:00

chore: use more chainsaw step templates (#11311)

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
Charles-Edouard Brétéché 2024-10-03 13:56:30 +02:00 committed by GitHub
parent decb7524eb
commit df267dd829
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
122 changed files with 868 additions and 978 deletions

View file

@ -4,12 +4,20 @@ metadata:
name: allows-rejects-creation name: allows-rejects-creation
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: require-labels
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-labels
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: applies-to-delete name: applies-to-delete
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,10 +4,20 @@ metadata:
name: conditions name: conditions
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: max-containers
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -4,12 +4,20 @@ metadata:
name: events-creation name: events-creation
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-latest-tag-events-creation
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-latest-tag-events-creation
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: exclude-capabilities name: exclude-capabilities
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa-1
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa-1
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: exclude-ephemeral-containers name: exclude-ephemeral-containers
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: require-run-as-nonroot
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-run-as-nonroot
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: exclude-host-ports name: exclude-host-ports
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa-3
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa-3
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: exclude-host-process-and-host-namespaces name: exclude-host-process-and-host-namespaces
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa-2
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa-2
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: exclude-hostpath-volume name: exclude-hostpath-volume
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: exclude-privilege-escalation name: exclude-privilege-escalation
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: exclude-privileged-containers name: exclude-privileged-containers
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: exclude-restricted-capabilities name: exclude-restricted-capabilities
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: exclude-restricted-seccomp name: exclude-restricted-seccomp
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: exclude-running-as-nonroot-user name: exclude-running-as-nonroot-user
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: exclude-running-as-nonroot name: exclude-running-as-nonroot
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: exclude-seccomp name: exclude-seccomp
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: exclude-selinux name: exclude-selinux
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: exclude-sysctls name: exclude-sysctls
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: exclude-volume-types name: exclude-volume-types
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psa
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psa
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,10 +4,20 @@ metadata:
name: conditions name: conditions
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
bindings:
- name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: max-containers
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -4,12 +4,20 @@ metadata:
name: multiple-exceptions-with-pod-security name: multiple-exceptions-with-pod-security
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psp-baseline
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psp-baseline
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: multiple-exceptions name: multiple-exceptions
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psp-baseline
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psp-baseline
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: only-for-specific-user name: only-for-specific-user
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: require-labels
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-labels
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: psa-run-as-non-root name: psa-run-as-non-root
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: psp-restricted-limited
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: psp-restricted-limited
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: with-wildcard name: with-wildcard
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: require-labels
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-labels
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: block-ephemeral-containers name: block-ephemeral-containers
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: block-ephemeral-containers
- name: step-02 - name: step-02
try: try:
- assert: - assert:

View file

@ -1,9 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: block-ephemeral-containers
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -12,12 +12,20 @@ spec:
try: try:
- script: - script:
content: kubectl run my-pod --image nginx -n pci content: kubectl run my-pod --image nginx -n pci
- name: step-03 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: deny-exec-by-namespace-name
- name: step-04 - name: step-04
try: try:
- assert: - assert:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: deny-exec-by-namespace-name
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-all-match-resource name: cpol-all-match-resource
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path-t9
- name: step-02 - name: step-02
try: try:
- assert: - assert:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path-t9
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-any-exclude-namespace-match-resource name: cpol-any-exclude-namespace-match-resource
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path-t16
- name: step-02 - name: step-02
try: try:
- assert: - assert:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path-t16
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-any-exclude-resource-match-with-namespace-selector name: cpol-any-exclude-resource-match-with-namespace-selector
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path-t14
- name: step-02 - name: step-02
try: try:
- assert: - assert:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path-t14
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-any-exclude-resource-match-with-object-selector name: cpol-any-exclude-resource-match-with-object-selector
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path-t15
- name: step-02 - name: step-02
try: try:
- assert: - assert:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path-t15
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-any-exclude-resource name: cpol-any-exclude-resource
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path-t13
- name: step-02 - name: step-02
try: try:
- assert: - assert:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path-t13
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-any-match-multiple-resources name: cpol-any-match-multiple-resources
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path-t8
- name: step-02 - name: step-02
try: try:
- assert: - assert:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path-t8
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-any-match-resource name: cpol-any-match-resource
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path-t7
- name: step-02 - name: step-02
try: try:
- assert: - assert:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path-t7
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-any-match-resources-by-names name: cpol-any-match-resources-by-names
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: check-label-app-4
- name: step-02 - name: step-02
try: try:
- assert: - assert:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: check-label-app-4
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-match-all-exclude-one name: cpol-match-all-exclude-one
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: check-label-app5
- name: step-02 - name: step-02
try: try:
- assert: - assert:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: check-label-app5
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-match-kind-with-wildcard name: cpol-match-kind-with-wildcard
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: check-label-app4
- name: step-02 - name: step-02
try: try:
- assert: - assert:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: check-label-app4
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-match-resource-in-specific-namespace name: cpol-match-resource-in-specific-namespace
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path-t4
- name: step-02 - name: step-02
try: try:
- assert: - assert:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path-t4
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-with-an-exception-excluding-namespaces name: cpol-with-an-exception-excluding-namespaces
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-with-an-exception name: cpol-with-an-exception
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-with-two-exceptions name: cpol-with-two-exceptions
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path
- name: step-02 - name: step-02
try: try:
- apply: - apply:

View file

@ -1,10 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-any-match-multiple-resources-with-namespace-selector name: cpol-any-match-multiple-resources-with-namespace-selector
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path-t12
- name: step-02 - name: step-02
try: try:
- error: - error:

View file

@ -1,12 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path-t12
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready
validatingadmissionpolicy:
generated: false

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-any-match-multiple-resources-with-object-selector name: cpol-any-match-multiple-resources-with-object-selector
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path-t13
- name: step-02 - name: step-02
try: try:
- error: - error:

View file

@ -1,12 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path-t13
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready
validatingadmissionpolicy:
generated: false

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-any-match-resources-by-names-with-wildcard name: cpol-any-match-resources-by-names-with-wildcard
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: check-label-app-3
- name: step-02 - name: step-02
try: try:
- error: - error:

View file

@ -1,12 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: check-label-app-3
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready
validatingadmissionpolicy:
generated: false

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-any-match-resources-in-namespaces-with-wildcard name: cpol-any-match-resources-in-namespaces-with-wildcard
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: check-label-app-5
- name: step-02 - name: step-02
try: try:
- error: - error:

View file

@ -1,12 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: check-label-app-5
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready
validatingadmissionpolicy:
generated: false

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-any-match-resources-with-different-namespace-selectors name: cpol-any-match-resources-with-different-namespace-selectors
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path-t1
- name: step-02 - name: step-02
try: try:
- error: - error:

View file

@ -1,12 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path-t1
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready
validatingadmissionpolicy:
generated: false

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-any-match-resources-with-different-object-selectors name: cpol-any-match-resources-with-different-object-selectors
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path-t2
- name: step-02 - name: step-02
try: try:
- error: - error:

View file

@ -1,12 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path-t2
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready
validatingadmissionpolicy:
generated: false

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-exclude-resources-in-specific-namespace name: cpol-exclude-resources-in-specific-namespace
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path-t17
- name: step-02 - name: step-02
try: try:
- error: - error:

View file

@ -1,12 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path-t17
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready
validatingadmissionpolicy:
generated: false

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-exclude-resources-with-namespace-selector name: cpol-exclude-resources-with-namespace-selector
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: disallow-host-path-t10
- name: step-02 - name: step-02
try: try:
- error: - error:

View file

@ -1,12 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path-t10
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready
validatingadmissionpolicy:
generated: false

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-exclude-resources-with-object-selector name: cpol-exclude-resources-with-object-selector
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: check-label-app2
- name: step-02 - name: step-02
try: try:
- error: - error:

View file

@ -1,12 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: check-label-app2
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready
validatingadmissionpolicy:
generated: false

View file

@ -4,12 +4,20 @@ metadata:
name: cpol-exclude-user-and-roles name: cpol-exclude-user-and-roles
spec: spec:
steps: steps:
- name: step-01 - name: create policy
try: use:
- apply: template: ../../../../../_step-templates/create-policy.yaml
file: policy.yaml with:
- assert: bindings:
file: policy-assert.yaml - name: file
value: policy.yaml
- name: wait policy ready
use:
template: ../../../../../_step-templates/cluster-policy-ready.yaml
with:
bindings:
- name: name
value: check-label-app1
- name: step-02 - name: step-02
try: try:
- error: - error:

View file

@ -1,12 +0,0 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: check-label-app1
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready
validatingadmissionpolicy:
generated: false

Some files were not shown because too many files have changed in this diff Show more