mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-05 15:37:19 +00:00
Removing additionalProperties from policy schema (#1891)
* removed additionalProperties from policy schema Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com> * added test cases Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
This commit is contained in:
Pooja Singh
GitHub
parent
9bdde7abea
commit
e62f23c6eb
2 changed files with 269 additions and 19 deletions
|
|
@ -122,9 +122,6 @@ const PolicyCRD = `
|
|||
"description": "ResourceDescription contains information about the resource being created or modified.",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations is a map of annotations (key-value pairs of type string). Annotation keys and values support the wildcard characters \"*\" (matches zero or many characters) and \"?\" (matches at least one character).",
|
||||
"type": "object"
|
||||
},
|
||||
|
|
@ -178,9 +175,6 @@ const PolicyCRD = `
|
|||
"type": "array"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
|
|
@ -233,9 +227,6 @@ const PolicyCRD = `
|
|||
"type": "array"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
|
|
@ -349,9 +340,6 @@ const PolicyCRD = `
|
|||
"description": "ResourceDescription contains information about the resource being created or modified. Requires at least one tag to be specified when under MatchResources.",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations is a map of annotations (key-value pairs of type string). Annotation keys and values support the wildcard characters \"*\" (matches zero or many characters) and \"?\" (matches at least one character).",
|
||||
"type": "object"
|
||||
},
|
||||
|
|
@ -405,9 +393,6 @@ const PolicyCRD = `
|
|||
"type": "array"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
|
|
@ -460,9 +445,6 @@ const PolicyCRD = `
|
|||
"type": "array"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13,6 +13,7 @@ func Test_validateUsingPolicyCRD(t *testing.T) {
|
|||
type TestCase struct {
|
||||
rawPolicy []byte
|
||||
errorDetail string
|
||||
detail string
|
||||
}
|
||||
|
||||
testcases := []TestCase{
|
||||
|
|
@ -57,7 +58,9 @@ func Test_validateUsingPolicyCRD(t *testing.T) {
|
|||
}
|
||||
`),
|
||||
errorDetail: "spec.rules.name in body should be at most 63 chars long",
|
||||
detail: "Test: char count for rule name",
|
||||
},
|
||||
|
||||
{
|
||||
rawPolicy: []byte(`
|
||||
{
|
||||
|
|
@ -92,6 +95,271 @@ func Test_validateUsingPolicyCRD(t *testing.T) {
|
|||
}
|
||||
`),
|
||||
errorDetail: "",
|
||||
detail: "Test: basic vaild policy",
|
||||
},
|
||||
|
||||
{
|
||||
rawPolicy: []byte(`
|
||||
{
|
||||
"apiVersion": "kyverno.io/v1",
|
||||
"kind": "ClusterPolicy",
|
||||
"metadata": {
|
||||
"name": "disallow-singleton"
|
||||
},
|
||||
"spec": {
|
||||
"validationFailureAction": "audit",
|
||||
"rules": [
|
||||
{
|
||||
"name": "validate-replicas",
|
||||
"match": {
|
||||
"resources": {
|
||||
"kinds": [
|
||||
"Deployment"
|
||||
],
|
||||
"annotations": {
|
||||
"singleton": "true"
|
||||
}
|
||||
}
|
||||
},
|
||||
"validate": {
|
||||
"message": "Replicasets require at least 2 replicas.",
|
||||
"pattern": {
|
||||
"spec": {
|
||||
"replicas": ">1"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
`),
|
||||
errorDetail: "",
|
||||
detail: "Test: schema validation for spec.rules.match.resources.annotations",
|
||||
},
|
||||
|
||||
{
|
||||
rawPolicy: []byte(`
|
||||
{
|
||||
"apiVersion": "kyverno.io/v1",
|
||||
"kind": "ClusterPolicy",
|
||||
"metadata": {
|
||||
"name": "disallow-singleton"
|
||||
},
|
||||
"spec": {
|
||||
"validationFailureAction": "audit",
|
||||
"rules": [
|
||||
{
|
||||
"name": "validate-replicas",
|
||||
"match": {
|
||||
"resources": {
|
||||
"kinds": [
|
||||
"Deployment"
|
||||
]
|
||||
}
|
||||
},
|
||||
"exclude": {
|
||||
"resources": {
|
||||
"annotations": {
|
||||
"singleton": "true"
|
||||
}
|
||||
}
|
||||
},
|
||||
"validate": {
|
||||
"message": "Replicasets require at least 2 replicas.",
|
||||
"pattern": {
|
||||
"spec": {
|
||||
"replicas": ">1"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
`),
|
||||
errorDetail: "",
|
||||
detail: "Test: schema validation for spec.rules.exclude.resources.annotations",
|
||||
},
|
||||
|
||||
{
|
||||
rawPolicy: []byte(`
|
||||
{
|
||||
"apiVersion": "kyverno.io/v1",
|
||||
"kind": "ClusterPolicy",
|
||||
"metadata": {
|
||||
"name": "enforce-pod-name"
|
||||
},
|
||||
"spec": {
|
||||
"validationFailureAction": "audit",
|
||||
"background": true,
|
||||
"rules": [
|
||||
{
|
||||
"name": "validate-name",
|
||||
"match": {
|
||||
"resources": {
|
||||
"kinds": [
|
||||
"Pod"
|
||||
],
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"app-namespace": "true"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"validate": {
|
||||
"message": "The Pod must end with -nginx",
|
||||
"pattern": {
|
||||
"metadata": {
|
||||
"name": "*-nginx"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
`),
|
||||
errorDetail: "",
|
||||
detail: "Test: schema validation for spec.rules.match.resources.namespaceSelector.matchLabels",
|
||||
},
|
||||
|
||||
{
|
||||
rawPolicy: []byte(`
|
||||
{
|
||||
"apiVersion": "kyverno.io/v1",
|
||||
"kind": "ClusterPolicy",
|
||||
"metadata": {
|
||||
"name": "enforce-pod-name"
|
||||
},
|
||||
"spec": {
|
||||
"validationFailureAction": "audit",
|
||||
"background": true,
|
||||
"rules": [
|
||||
{
|
||||
"name": "validate-name",
|
||||
"match": {
|
||||
"resources": {
|
||||
"kinds": [
|
||||
"Pod"
|
||||
]
|
||||
}
|
||||
},
|
||||
"exclude": {
|
||||
"resources": {
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"app-namespace": "true"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"validate": {
|
||||
"message": "The Pod must end with -nginx",
|
||||
"pattern": {
|
||||
"metadata": {
|
||||
"name": "*-nginx"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
`),
|
||||
errorDetail: "",
|
||||
detail: "Test: schema validation for spec.rules.exclude.resources.namespaceSelector.matchLabels",
|
||||
},
|
||||
|
||||
{
|
||||
rawPolicy: []byte(`
|
||||
{
|
||||
"apiVersion": "kyverno.io/v1",
|
||||
"kind": "ClusterPolicy",
|
||||
"metadata": {
|
||||
"name": "enforce-pod-name"
|
||||
},
|
||||
"spec": {
|
||||
"validationFailureAction": "audit",
|
||||
"background": true,
|
||||
"rules": [
|
||||
{
|
||||
"name": "validate-name",
|
||||
"match": {
|
||||
"resources": {
|
||||
"kinds": [
|
||||
"Pod"
|
||||
],
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app-namespace": "true"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"validate": {
|
||||
"message": "The Pod must end with -nginx",
|
||||
"pattern": {
|
||||
"metadata": {
|
||||
"name": "*-nginx"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
`),
|
||||
errorDetail: "",
|
||||
detail: "Test: schema validation for spec.rules.match.resources.selector.matchLabels",
|
||||
},
|
||||
|
||||
{
|
||||
rawPolicy: []byte(`
|
||||
{
|
||||
"apiVersion": "kyverno.io/v1",
|
||||
"kind": "ClusterPolicy",
|
||||
"metadata": {
|
||||
"name": "enforce-pod-name"
|
||||
},
|
||||
"spec": {
|
||||
"validationFailureAction": "audit",
|
||||
"background": true,
|
||||
"rules": [
|
||||
{
|
||||
"name": "validate-name",
|
||||
"match": {
|
||||
"resources": {
|
||||
"kinds": [
|
||||
"Pod"
|
||||
]
|
||||
}
|
||||
},
|
||||
"exclude": {
|
||||
"resources": {
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app-namespace": "true"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"validate": {
|
||||
"message": "The Pod must end with -nginx",
|
||||
"pattern": {
|
||||
"metadata": {
|
||||
"name": "*-nginx"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
`),
|
||||
errorDetail: "",
|
||||
detail: "Test: schema validation for spec.rules.exclude.resources.selector.matchLabels",
|
||||
},
|
||||
}
|
||||
|
||||
|
|
@ -104,7 +372,7 @@ func Test_validateUsingPolicyCRD(t *testing.T) {
|
|||
assert.NilError(t, err)
|
||||
|
||||
_, errorList := validatePolicyAccordingToPolicyCRD(&policy, v1crd)
|
||||
fmt.Println("errorList: ", errorList)
|
||||
fmt.Println(tc.detail)
|
||||
for _, e := range errorList {
|
||||
assert.Assert(t, tc.errorDetail == e.Detail)
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue