mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-28 10:28:36 +00:00
test: add kuttl tests for background only policies (#7709)
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
Charles-Edouard Brétéché
GitHub
parent
c5ebb73231
commit
f6933f11f3
55 changed files with 516 additions and 0 deletions
1
.github/workflows/conformance.yaml
vendored
1
.github/workflows/conformance.yaml
vendored
|
|
@ -57,6 +57,7 @@ jobs:
|
|||
version: v1.27.1
|
||||
tests:
|
||||
- autogen
|
||||
- background-only
|
||||
- cleanup
|
||||
- deferred
|
||||
- events
|
||||
|
|
|
|||
|
|
@ -0,0 +1,6 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
apply:
|
||||
- policy.yaml
|
||||
assert:
|
||||
- policy-assert.yaml
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
apply:
|
||||
- resource.yaml
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
assert:
|
||||
- background-event.yaml
|
||||
error:
|
||||
- admission-event.yaml
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
## Description
|
||||
|
||||
This test creates a policy with `admission` set to `false`.
|
||||
Then it creates a resource that violates the policy.
|
||||
|
||||
## Expected Behavior
|
||||
|
||||
The resource creates fine as the policy doesn't apply at admission time.
|
||||
No admission ezvent is created.
|
||||
One background event is created.
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
apiVersion: v1
|
||||
involvedObject:
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
name: pod
|
||||
kind: Event
|
||||
metadata: {}
|
||||
source:
|
||||
component: kyverno-admission
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
apiVersion: v1
|
||||
involvedObject:
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
name: pod
|
||||
kind: Event
|
||||
metadata: {}
|
||||
source:
|
||||
component: kyverno-scan
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: validate
|
||||
spec: {}
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: validate
|
||||
spec:
|
||||
validationFailureAction: Enforce
|
||||
admission: false
|
||||
background: true
|
||||
rules:
|
||||
- name: validate
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
deny: {}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: pod
|
||||
spec:
|
||||
containers:
|
||||
- name: container
|
||||
image: nginx:latest
|
||||
ports:
|
||||
- containerPort: 80
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
apply:
|
||||
- policy.yaml
|
||||
assert:
|
||||
- policy-assert.yaml
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
apply:
|
||||
- resource.yaml
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
error:
|
||||
- admission-report.yaml
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
## Description
|
||||
|
||||
This test creates a policy with `admission` set to `false`.
|
||||
Then it creates a resource that violates the policy.
|
||||
|
||||
## Expected Behavior
|
||||
|
||||
The resource creates fine as the policy doesn't apply at admission time.
|
||||
No admission report is created.
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
apiVersion: kyverno.io/v1alpha2
|
||||
kind: AdmissionReport
|
||||
metadata:
|
||||
ownerReferences:
|
||||
- apiVersion: v1
|
||||
kind: Pod
|
||||
name: pod
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: validate
|
||||
spec: {}
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: validate
|
||||
spec:
|
||||
validationFailureAction: Enforce
|
||||
admission: false
|
||||
background: true
|
||||
rules:
|
||||
- name: validate
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
deny: {}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: pod
|
||||
spec:
|
||||
containers:
|
||||
- name: container
|
||||
image: nginx:latest
|
||||
ports:
|
||||
- containerPort: 80
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
apply:
|
||||
- policy.yaml
|
||||
assert:
|
||||
- policy-assert.yaml
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
apply:
|
||||
- resource.yaml
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
## Description
|
||||
|
||||
This test creates a policy with `admission` set to `false`.
|
||||
Then it creates a resource that violates the policy.
|
||||
|
||||
## Expected Behavior
|
||||
|
||||
The resource creates fine as the policy doesn't apply at admission time.
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: validate
|
||||
spec: {}
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: validate
|
||||
spec:
|
||||
validationFailureAction: Enforce
|
||||
admission: false
|
||||
background: true
|
||||
rules:
|
||||
- name: validate
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
deny: {}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: pod
|
||||
spec:
|
||||
containers:
|
||||
- name: container
|
||||
image: nginx:latest
|
||||
ports:
|
||||
- containerPort: 80
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
apply:
|
||||
- policy.yaml
|
||||
assert:
|
||||
- policy-assert.yaml
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
apply:
|
||||
- resource.yaml
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
assert:
|
||||
- background-event.yaml
|
||||
error:
|
||||
- admission-event.yaml
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
## Description
|
||||
|
||||
This test creates a policy with `admission` set to `false`.
|
||||
Then it creates a resource that violates the policy.
|
||||
|
||||
## Expected Behavior
|
||||
|
||||
The resource creates fine as the policy doesn't apply at admission time.
|
||||
No admission ezvent is created.
|
||||
One background event is created.
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
apiVersion: v1
|
||||
involvedObject:
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
name: pod
|
||||
kind: Event
|
||||
metadata: {}
|
||||
source:
|
||||
component: kyverno-admission
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
apiVersion: v1
|
||||
involvedObject:
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
name: pod
|
||||
kind: Event
|
||||
metadata: {}
|
||||
source:
|
||||
component: kyverno-scan
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: validate
|
||||
spec: {}
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: validate
|
||||
spec:
|
||||
validationFailureAction: Enforce
|
||||
admission: false
|
||||
background: true
|
||||
rules:
|
||||
- name: validate
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
deny: {}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: pod
|
||||
spec:
|
||||
containers:
|
||||
- name: container
|
||||
image: nginx:latest
|
||||
ports:
|
||||
- containerPort: 80
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
apply:
|
||||
- policy.yaml
|
||||
assert:
|
||||
- policy-assert.yaml
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
apply:
|
||||
- resource.yaml
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
error:
|
||||
- admission-report.yaml
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
## Description
|
||||
|
||||
This test creates a policy with `admission` set to `false`.
|
||||
Then it creates a resource that violates the policy.
|
||||
|
||||
## Expected Behavior
|
||||
|
||||
The resource creates fine as the policy doesn't apply at admission time.
|
||||
No admission report is created.
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
apiVersion: kyverno.io/v1alpha2
|
||||
kind: AdmissionReport
|
||||
metadata:
|
||||
ownerReferences:
|
||||
- apiVersion: v1
|
||||
kind: Pod
|
||||
name: pod
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: validate
|
||||
spec: {}
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: validate
|
||||
spec:
|
||||
validationFailureAction: Enforce
|
||||
admission: false
|
||||
background: true
|
||||
rules:
|
||||
- name: validate
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
deny: {}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: pod
|
||||
spec:
|
||||
containers:
|
||||
- name: container
|
||||
image: nginx:latest
|
||||
ports:
|
||||
- containerPort: 80
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
apply:
|
||||
- policy.yaml
|
||||
assert:
|
||||
- policy-assert.yaml
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
apply:
|
||||
- resource.yaml
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
## Description
|
||||
|
||||
This test creates a policy with `admission` set to `false`.
|
||||
Then it creates a resource that violates the policy.
|
||||
|
||||
## Expected Behavior
|
||||
|
||||
The resource creates fine as the policy doesn't apply at admission time.
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: validate
|
||||
spec: {}
|
||||
status:
|
||||
conditions:
|
||||
- reason: Succeeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: validate
|
||||
spec:
|
||||
validationFailureAction: Enforce
|
||||
admission: false
|
||||
background: true
|
||||
rules:
|
||||
- name: validate
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
deny: {}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: pod
|
||||
spec:
|
||||
containers:
|
||||
- name: container
|
||||
image: nginx:latest
|
||||
ports:
|
||||
- containerPort: 80
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
apply:
|
||||
- file: policy-validate.yaml
|
||||
- file: policy-mutate.yaml
|
||||
shouldFail: true
|
||||
- file: policy-verify-image.yaml
|
||||
shouldFail: true
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
## Description
|
||||
|
||||
This test tries to create various policies with `admission` set to `false`.
|
||||
|
||||
## Expected Behavior
|
||||
|
||||
Policies containing mutation, image verification or generation rules should be rejected.
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: mutate
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
admission: false
|
||||
background: true
|
||||
rules:
|
||||
- name: mutate
|
||||
match:
|
||||
resources:
|
||||
kinds:
|
||||
- Pod
|
||||
- Service
|
||||
- ConfigMap
|
||||
- Secret
|
||||
mutate:
|
||||
patchStrategicMerge:
|
||||
metadata:
|
||||
labels:
|
||||
foo: bar
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: validate
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
admission: false
|
||||
background: true
|
||||
rules:
|
||||
- name: validate
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
deny: {}
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: verify-image
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
admission: false
|
||||
background: true
|
||||
rules:
|
||||
- name: verify-image
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/kyverno/test-verify-image:*"
|
||||
attestors:
|
||||
- entries:
|
||||
- keys:
|
||||
publicKeys: |-
|
||||
-----BEGIN PUBLIC KEY-----
|
||||
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8nXRh950IZbRj8Ra/N9sbqOPZrfM
|
||||
5/KAQN0/KjHcorm/J5yctVd7iEcnessRQjU917hmKO6JWVGHpDguIyakZA==
|
||||
-----END PUBLIC KEY-----
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
apiVersion: kuttl.dev/v1beta1
|
||||
kind: TestStep
|
||||
apply:
|
||||
- file: policy.yaml
|
||||
shouldFail: true
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
## Description
|
||||
|
||||
This test tries to create a policy with both `admission` and `background` set to `false`.
|
||||
|
||||
## Expected Behavior
|
||||
|
||||
Policy should be rejected.
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: all-disabled
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
admission: false
|
||||
background: false
|
||||
rules:
|
||||
- name: validate
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
deny: {}
|
||||
Loading…
Add table
Reference in a new issue