From f89eca87da28c44c41ed57b54baba1ff58ff5cbf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Charles-Edouard=20Br=C3=A9t=C3=A9ch=C3=A9?= Date: Mon, 2 Sep 2024 17:36:02 +0200 Subject: [PATCH] chore: use dynamic matrix (#10973) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * chore: simplify e2e matrix Signed-off-by: Charles-Edouard Brétéché * chore: use dynamic matrix Signed-off-by: Charles-Edouard Brétéché --------- Signed-off-by: Charles-Edouard Brétéché --- .github/e2e-matrix.json | 184 +++++++++++++++++++++++++++++ .github/workflows/conformance.yaml | 61 ++++++---- 2 files changed, 219 insertions(+), 26 deletions(-) create mode 100644 .github/e2e-matrix.json diff --git a/.github/e2e-matrix.json b/.github/e2e-matrix.json new file mode 100644 index 0000000000..701b1d6851 --- /dev/null +++ b/.github/e2e-matrix.json @@ -0,0 +1,184 @@ +{ + "assert": [ + "^assert$/^(old-object-exists)\\[.*\\]$" + ], + "autogen": [ + "^autogen$/^(assert-autogen|conditions|conditions-deprecated|deployment-cronjob|deployment-cronjob-deprecated|deployment-statefulset-job|foreach-jsonpatch|none|none-deprecated|only-cronjob|only-deployment|restrict-image-registries)\\[.*\\]$", + "^autogen$/^(should-autogen|should-autogen-deprecated|should-not-autogen|should-not-autogen-deprecated)\\[.*\\]$" + ], + "background-only": [ + "^background-only$/^cluster-policy$/^(no-admission-event|no-admission-event-deprecated|no-admission-report|no-admission-report-deprecated|not-rejected|not-rejected-deprecated)\\[.*\\]$", + "^background-only$/^policy$/^(no-admission-event|no-admission-event-deprecated|no-admission-report|no-admission-report-deprecated|not-rejected|not-rejected-deprecated)\\[.*\\]$" + ], + "cleanup": [ + "^cleanup$/^v2$/^clusterpolicy$/^(cleanup-pod|context-cleanup-pod)\\[.*\\]$", + "^cleanup$/^v2$/^policy$/^(cleanup-pod)\\[.*\\]$", + "^cleanup$/^v2$/^validation$/^(cron-format|no-user-info-in-match|not-supported-attributes-in-context)\\[.*\\]$", + "^cleanup$/^v2beta1$/^clusterpolicy$/^(cleanup-pod|context-cleanup-pod)\\[.*\\]$", + "^cleanup$/^v2beta1$/^policy$/^(cleanup-pod)\\[.*\\]$", + "^cleanup$/^v2beta1$/^validation$/^(cron-format|no-user-info-in-match|not-supported-attributes-in-context)\\[.*\\]$" + ], + "cli": [ + "^cli$/^apply$/^(apply-exception-with-ns-selector|apply-on-cluster-scoped-resources|warn-exit-code)\\[.*\\]$" + ], + "custom-sigstore": [ + "^custom-sigstore$/^standard$/^(basic|basic-deprecated)\\[.*\\]$" + ], + "deferred": [ + "^deferred$/^(dependencies|dependencies-deprecated|foreach|recursive|resolve-overriden-variable|two-rules)\\[.*\\]$" + ], + "events": [ + "^events$/^clusterpolicy$/^(generate-events-upon-fail-generation|generate-events-upon-successful-generation|generate-events-upon-successful-mutation|message-exceeds-1024-characters|no-events-upon-skip-generation)\\[.*\\]$", + "^events$/^policy$/^(policy-applied|policy-applied-deprecated|policy-violation|policy-violation-deprecated)\\[.*\\]$" + ], + "exceptions": [ + "^exceptions$/^(allows-rejects-creation|applies-to-delete|conditions|events-creation|exclude-capabilities|exclude-ephemeral-containers|exclude-host-ports|exclude-host-process-and-host-namespaces|exclude-hostpath-volume|exclude-privilege-escalation|exclude-privileged-containers|exclude-restricted-capabilities)\\[.*\\]$", + "^exceptions$/^(exclude-restricted-seccomp|exclude-running-as-nonroot|exclude-running-as-nonroot-user|exclude-seccomp|exclude-selinux|exclude-sysctls|exclude-volume-types|good-bad-conditions|multiple-exceptions|multiple-exceptions-with-pod-security|only-for-specific-user|psa-run-as-non-root)\\[.*\\]$", + "^exceptions$/^(with-wildcard)\\[.*\\]$", + "^exceptions$/^background-mode$/^(standard)\\[.*\\]$" + ], + "filter": [ + "^filter$/^exclude$/^sa$/^(no-wildcard|wildcard)\\[.*\\]$", + "^filter$/^exclude$/^user$/^no-wildcard$/^(block|pass)\\[.*\\]$", + "^filter$/^exclude$/^user$/^wildcard$/^(block|pass)\\[.*\\]$", + "^filter$/^match$/^sa$/^(no-wildcard|wildcard)\\[.*\\]$", + "^filter$/^match$/^user$/^no-wildcard$/^(block|pass)\\[.*\\]$", + "^filter$/^match$/^user$/^wildcard$/^(block|pass)\\[.*\\]$" + ], + "flags": [ + "^flags$/^standard$/^(emit-events)\\[.*\\]$" + ], + "force-failure-policy-ignore": [ + "^force-failure-policy-ignore$/^cluster-policy$/^(fail|fail-deprecated)\\[.*\\]$" + ], + "generate": [ + "^generate$/^clusterpolicy$/^cornercases$/^(clone-list-sync-same-trigger-source-delete-source|clone-list-sync-same-trigger-source-update-source|clone-role-and-rolebinding|clone-source-name-exceeds-63-characters|clone-sync-same-trigger-source-delete-source|clone-sync-same-trigger-source-update-source|cpol-clone-create-on-trigger-deletion|cpol-clone-delete-ownerreferences-across-namespaces|cpol-clone-delete-ownerreferences-across-namespaces-deprecated|cpol-clone-sync-create-source-after-policy|cpol-clone-sync-reinstall-policy|cpol-clone-sync-reinstall-policy-deprecated)\\[.*\\]$", + "^generate$/^clusterpolicy$/^cornercases$/^(cpol-clone-sync-single-source-multiple-triggers-targets|cpol-clone-sync-single-source-multiple-triggers-targets-deprecated|cpol-clone-sync-single-trigger-source-multiple-targets|cpol-data-create-on-trigger-deletion|cpol-data-sync-create-upon-generated-resource|cpol-data-sync-no-creation-upon-generated-resource|cpol-data-sync-remove-list-element|cpol-data-sync-to-nosync-delete-rule|cpol-data-sync-to-nosync-delete-rule-deprecated|cpol-data-trigger-not-present|data-role-and-rolebinding|generate-event-upon-edit)\\[.*\\]$", + "^generate$/^clusterpolicy$/^cornercases$/^(pod-restart-on-cm-update|pod-restart-on-cm-update-deprecated|trigger-resource-name-exceeds-63-characters)\\[.*\\]$", + "^generate$/^clusterpolicy$/^standard$/^clone$/^multiple$/^sync$/^(basic-create)\\[.*\\]$", + "^generate$/^clusterpolicy$/^standard$/^clone$/^nosync$/^(cpol-clone-nosync-create|cpol-clone-nosync-delete-downstream|cpol-clone-nosync-delete-policy|cpol-clone-nosync-delete-rule|cpol-clone-nosync-delete-source|cpol-clone-nosync-delete-trigger|cpol-clone-nosync-modify-downstream|cpol-clone-nosync-modify-source|cpol-clone-nosync-update-trigger-no-match)\\[.*\\]$", + "^generate$/^clusterpolicy$/^standard$/^clone$/^sync$/^(cpol-clone-list-sync-create|cpol-clone-list-sync-create-deprecated|cpol-clone-list-sync-delete-source|cpol-clone-list-sync-update|cpol-clone-list-sync-update-deprecated|cpol-clone-sync-create|cpol-clone-sync-delete-downstream|cpol-clone-sync-delete-policy|cpol-clone-sync-delete-rule|cpol-clone-sync-delete-source|cpol-clone-sync-delete-trigger|cpol-clone-sync-existing-update-trigger-no-precondition)\\[.*\\]$", + "^generate$/^clusterpolicy$/^standard$/^clone$/^sync$/^(cpol-clone-sync-existing-update-trigger-no-precondition-deprecated|cpol-clone-sync-modify-downstream|cpol-clone-sync-modify-downstream-apply|cpol-clone-sync-modify-source|cpol-clone-sync-no-existing-update-trigger-no-precondition|cpol-clone-sync-update-trigger-no-match)\\[.*\\]$", + "^generate$/^clusterpolicy$/^standard$/^data$/^nosync$/^(cpol-data-nosync-delete-downstream|cpol-data-nosync-delete-policy|cpol-data-nosync-delete-rule|cpol-data-nosync-delete-trigger|cpol-data-nosync-modify-downstream|cpol-data-nosync-modify-rule|cpol-data-nosync-update-trigger-no-match|generate-on-subresource-trigger)\\[.*\\]$", + "^generate$/^clusterpolicy$/^standard$/^data$/^nosync-deprecated$/^(cpol-data-nosync-delete-downstream|cpol-data-nosync-delete-policy|cpol-data-nosync-delete-rule|cpol-data-nosync-modify-downstream|cpol-data-nosync-modify-rule|generate-on-subresource-trigger)\\[.*\\]$", + "^generate$/^clusterpolicy$/^standard$/^data$/^sync$/^(cpol-data-sync-create|cpol-data-sync-delete-downstream|cpol-data-sync-delete-one-trigger|cpol-data-sync-delete-policy|cpol-data-sync-delete-rule|cpol-data-sync-delete-trigger|cpol-data-sync-existing-update-trigger-no-precondition|cpol-data-sync-modify-downstream|cpol-data-sync-modify-policy|cpol-data-sync-modify-rule|cpol-data-sync-mutate-and-generate|cpol-data-sync-no-existing-update-trigger-no-precondition)\\[.*\\]$", + "^generate$/^clusterpolicy$/^standard$/^data$/^sync$/^(cpol-data-sync-orphan-downstream-delete-policy|cpol-data-sync-update-trigger-no-match)\\[.*\\]$", + "^generate$/^clusterpolicy$/^standard$/^data$/^sync-deprecated$/^(cpol-data-sync-create|cpol-data-sync-delete-downstream|cpol-data-sync-delete-policy|cpol-data-sync-delete-rule|cpol-data-sync-existing-update-trigger-no-precondition|cpol-data-sync-modify-downstream|cpol-data-sync-modify-rule|cpol-data-sync-orphan-downstream-delete-policy)\\[.*\\]$", + "^generate$/^clusterpolicy$/^standard$/^existing$/^(different-configurations-for-generate-existing|different-generate-existing-values|different-generate-existing-values-reorder|existing-basic-add-rule-data|existing-basic-create-policy-data|existing-basic-create-policy-preconditions-data|existing-with-wildcard-name-matching)\\[.*\\]$", + "^generate$/^clusterpolicy$/^standard$/^existing-deprecated$/^(existing-basic-add-rule-data|existing-basic-create-policy-data|existing-basic-create-policy-preconditions-data)\\[.*\\]$", + "^generate$/^foreach$/^clusterpolicy$/^clone$/^sync$/^(cpol-clone-list-sync-delete-source|cpol-clone-sync-create|cpol-clone-sync-create-delete-source)\\[.*\\]$", + "^generate$/^foreach$/^clusterpolicy$/^data$/^sync$/^(cpol-data-sync-create|cpol-data-sync-delete-policy)\\[.*\\]$", + "^generate$/^foreach$/^existing$/^(cpol-clone-sync-create)\\[.*\\]$", + "^generate$/^policy$/^cornercases$/^(pol-clone-create-on-trigger-deletion|pol-clone-sync-create-source-after-policy|pol-data-create-on-trigger-deletion)\\[.*\\]$", + "^generate$/^policy$/^standard$/^clone$/^nosync$/^(pol-clone-nosync-create|pol-clone-nosync-delete-downstream|pol-clone-nosync-delete-policy|pol-clone-nosync-delete-rule|pol-clone-nosync-delete-source|pol-clone-nosync-delete-trigger|pol-clone-nosync-invalid|pol-clone-nosync-modify-downstream|pol-clone-nosync-modify-source|pol-clone-nosync-update-trigger-no-match)\\[.*\\]$", + "^generate$/^policy$/^standard$/^clone$/^sync$/^(pol-clone-sync-delete-downstream|pol-clone-sync-delete-policy|pol-clone-sync-delete-rule|pol-clone-sync-delete-source|pol-clone-sync-delete-trigger|pol-clone-sync-invalid|pol-clone-sync-modify-downstream|pol-clone-sync-modify-source|pol-clone-sync-update-trigger-no-match)\\[.*\\]$", + "^generate$/^policy$/^standard$/^data$/^nosync$/^(pol-data-nosync-create-policy-invalid|pol-data-nosync-delete-downstream|pol-data-nosync-delete-policy|pol-data-nosync-delete-rule|pol-data-nosync-delete-rule-deprecated|pol-data-nosync-delete-trigger|pol-data-nosync-modify-downstream|pol-data-nosync-modify-rule|pol-data-nosync-update-trigger-no-match)\\[.*\\]$", + "^generate$/^policy$/^standard$/^data$/^sync$/^(pol-data-sync-create-policy-invalid|pol-data-sync-create-policy-valid|pol-data-sync-delete-downstream|pol-data-sync-delete-policy|pol-data-sync-delete-rule|pol-data-sync-delete-rule-deprecated|pol-data-sync-delete-trigger|pol-data-sync-modify-downstream|pol-data-sync-modify-rule|pol-data-sync-modify-rule-deprecated|pol-data-sync-update-trigger-no-match)\\[.*\\]$", + "^generate$/^policy$/^standard$/^existing$/^(match-trigger-namespace|match-trigger-namespace-deprecated|non-match-trigger-namespace|non-match-trigger-namespace-deprecated)\\[.*\\]$", + "^generate$/^validation$/^clusterpolicy$/^(cloneList|immutable-clone|immutable-clonelist|immutable-downstream|immutable-rule-spec|orphan|prevent-loop|target-namespace-scope|use-generate-existing-on-policy-update)\\[.*\\]$", + "^generate$/^validation$/^clusterpolicy$/^permissions$/^(no-permission|same-kind)\\[.*\\]$", + "^generate$/^validation$/^policy$/^(cloneList|immutable-clone|immutable-clonelist|immutable-downstream|immutable-rule-spec|permissions|prevent-loop|target-namespace-scope|use-generate-existing-on-policy-update)\\[.*\\]$" + ], + "generate-validating-admission-policy": [ + "^generate-validating-admission-policy$/^clusterpolicy$/^standard$/^generate$/^(block-ephemeral-containers|block-exec-in-pods|cpol-all-match-resource|cpol-any-exclude-namespace-match-resource|cpol-any-exclude-resource|cpol-any-exclude-resource-match-with-namespace-selector|cpol-any-exclude-resource-match-with-object-selector|cpol-any-match-multiple-resources|cpol-any-match-resource|cpol-any-match-resources-by-names|cpol-match-all-exclude-one|cpol-match-kind-with-wildcard)\\[.*\\]$", + "^generate-validating-admission-policy$/^clusterpolicy$/^standard$/^generate$/^(cpol-match-resource-in-specific-namespace|cpol-with-an-exception|cpol-with-an-exception-excluding-namespaces|cpol-with-two-exceptions)\\[.*\\]$", + "^generate-validating-admission-policy$/^clusterpolicy$/^standard$/^skip-generate$/^(cpol-any-match-multiple-resources-with-namespace-selector|cpol-any-match-multiple-resources-with-object-selector|cpol-any-match-resources-by-names-with-wildcard|cpol-any-match-resources-in-namespaces-with-wildcard|cpol-any-match-resources-with-different-namespace-selectors|cpol-any-match-resources-with-different-object-selectors|cpol-exclude-resources-in-specific-namespace|cpol-exclude-resources-with-namespace-selector|cpol-exclude-resources-with-object-selector|cpol-exclude-user-and-roles|cpol-match-resource-created-by-user|cpol-match-resource-using-annotations)\\[.*\\]$", + "^generate-validating-admission-policy$/^clusterpolicy$/^standard$/^skip-generate$/^(cpol-multiple-all-match-resources|cpol-multiple-rules|cpol-multiple-validation-failure-action-overrides|cpol-non-cel-rule|cpol-validation-failure-action-overrides-with-namespace|cpol-with-exception-and-conditions|cpol-with-exception-and-namespace-selector|cpol-with-exception-and-object-selector|cpol-with-exception-in-specific-namespace)\\[.*\\]$" + ], + "globalcontext": [ + "^globalcontext$/^(apicall-correct|apicall-failed|gctxentry-not-exist|not-ready|resource-correct|validate-apicall-data|validate-crd|validate-reference)\\[.*\\]$" + ], + "lease": [ + "^lease$/^(admission-controller|background-controller|cleanup-controller|reports-controller)\\[.*\\]$" + ], + "mutate": [ + "^mutate$/^cascading$/^(first-rule-is-foreach|no-foreach|two-foreach-rules)\\[.*\\]$", + "^mutate$/^clusterpolicy$/^cornercases$/^(cascading-mutation|defaulting-namespace-labels|jmespath-with-special-chars|mutate-using-default-context|mutate-with-404-api-call|trigger-name-exceeds-63-characters|variables-mutate-existing|variables-mutate-existing-deprecated)\\[.*\\]$", + "^mutate$/^clusterpolicy$/^standard$/^(basic-check-output|mutate-node-status|userInfo-roles-clusterRoles)\\[.*\\]$", + "^mutate$/^clusterpolicy$/^standard$/^existing$/^(background-false|background-false(deprecated)|basic-create|basic-create(deprecated)|basic-create-patchesJson6902|basic-create-patchesJson6902(deprecated)|basic-delete|basic-delete(deprecated)|basic-update|basic-update(deprecated)|delete-trigger-namespace|delete-trigger-namespace(deprecated))\\[.*\\]$", + "^mutate$/^clusterpolicy$/^standard$/^existing$/^(descending-patchJson6902|multiple-rules-match-exclude|multiple-rules-match-exclude(deprecated)|multiple-trigger-resources|multiple-trigger-resources(deprecated)|mutate-existing-node-status|mutate-pod-on-binding-request|namespaceselector|namespaceselector(deprecated)|preconditions|preconditions(deprecated)|target-context)\\[.*\\]$", + "^mutate$/^clusterpolicy$/^standard$/^existing$/^(target-preconditions)\\[.*\\]$", + "^mutate$/^clusterpolicy$/^standard$/^existing$/^onpolicyupdate$/^(basic-create-policy|basic-create-policy(deprecated)|different-configurations-for-mutate-existing|different-mutate-existing-values|namespaceselector|namespaceselector(deprecated))\\[.*\\]$", + "^mutate$/^clusterpolicy$/^standard$/^existing$/^validation$/^(mutate-existing-require-targets|mutate-existing-require-targets(deprecated)|target-variable-validation|target-variable-validation(deprecated))\\[.*\\]$", + "^mutate$/^clusterpolicy$/^standard$/^existing$/^validation$/^auth-check$/^(cpol-namespace-variable|cpol-namespace-variable(deprecated)|cpol-standard-auth-check|cpol-standard-auth-check(deprecated))\\[.*\\]$", + "^mutate$/^e2e$/^(foreach-patchStrategicMerge-context|foreach-patchStrategicMerge-preconditions|jmespath-logic|patchStrategicMerge-global|patchStrategicMerge-global-addifnotpresent|patchesJson6902-replace|patchesjson6902-simple|simple-conditional|variables-in-keys)\\[.*\\]$", + "^mutate$/^policy$/^cornercases$/^(foreach-remove-elements)\\[.*\\]$", + "^mutate$/^policy$/^standard$/^existing$/^validation$/^(auth-check)\\[.*\\]$", + "^mutate$/^refactor$/^(k10-minimum-retention)\\[.*\\]$", + "^mutate$/^refactor$/^foreach$/^(add-and-remove|remove-and-add|remove-multiple-elements-in-ascending-order|remove-multiple-elements-in-descending-order)\\[.*\\]$", + "^mutate$/^refactor$/^nested-foreach$/^(remove-all-env-vars)\\[.*\\]$", + "^mutate$/^refactor$/^simple$/^(remove-multiple-elements-in-ascending-order|remove-multiple-elements-in-descending-order)\\[.*\\]$" + ], + "policy-validation": [ + "^policy-validation$/^cluster-policy$/^(admission-disabled|all-disabled|assert|background-subresource|background-variables-update|cel-expressions|deprecated-operations|invalid-pod-security-exceptions|invalid-pod-security-rule|invalid-subject-kind|invalid-timeout|invalid-timeout-deprecated)\\[.*\\]$", + "^policy-validation$/^cluster-policy$/^(policy-exceptions-disabled|schema-validation-crd|success|target-context)\\[.*\\]$", + "^policy-validation$/^policy$/^(admission-disabled|all-disabled|assert|background-subresource|invalid-timeout)\\[.*\\]$" + ], + "rangeoperators": [ + "^rangeoperators$/^(standard)\\[.*\\]$" + ], + "rbac": [ + "^rbac$/^(aggregate-to-admin|cleanup-policy-with-clusterrole|mutate-policy-with-clusterrole)\\[.*\\]$" + ], + "reports": [ + "^reports$/^admission$/^(exception|namespaceselector|namespaceselector-assert|test-report-admission-mode|two-rules-with-different-modes|update)\\[.*\\]$", + "^reports$/^background$/^(exception|exception-assert|exception-with-conditions|exception-with-podsecurity|multiple-exceptions-with-pod-security|report-deletion|test-report-background-mode|two-rules-with-different-modes|verify-image-fail|verify-image-pass)\\[.*\\]$" + ], + "ttl": [ + "^ttl$/^(delete-twice|invalid-label|past-timestamp|permission-lack|valid-label)\\[.*\\]$" + ], + "validate": [ + "^validate$/^anchors$/^(conditional|conditional-deprecated)\\[.*\\]$", + "^validate$/^clusterpolicy$/^cornercases$/^(apply-on-deletion|apply-on-deletion-deprecated|cel-messages-upon-resource-failure|cel-messages-upon-resource-failure-deprecated|check-message-upon-resource-failure|check-message-upon-resource-failure-deprecated|different-configuration-for-actions|ephemeral-containers|ephemeral-containers-deprecated|external-metrics|external-metrics-deprecated|invalid-jmespath-variable-substitution)\\[.*\\]$", + "^validate$/^clusterpolicy$/^cornercases$/^(invalid-jmespath-variable-substitution-deprecated|psa-run-as-non-root|schema-validation-for-mutateExisting|schema-validation-for-mutateExisting-deprecated|two-rules-with-different-action|validate-pattern-should-fail|validate-pattern-should-fail-deprecated|validate-pattern-should-pass|validate-pattern-should-pass-deprecated|validate-pattern-should-skip|validate-pattern-should-skip-deprecated|variable-substitution-failure-messages)\\[.*\\]$", + "^validate$/^clusterpolicy$/^cornercases$/^(variable-substitution-failure-messages-deprecated)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^(gvk|gvk-deprecated|subresource|subresource-deprecated)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^apicalls$/^(lazyload|subjectaccessreview)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^apicalls-deprecated$/^(lazyload|subjectaccessreview)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^audit$/^(background-match-clusterRoles|background-match-roles|background-vars-roles|background-vars-serviceAccountName|background-vars-userInfo|configmap-context-lookup)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^audit-deprecated$/^(background-match-clusterRoles|background-match-roles|background-vars-roles|background-vars-serviceAccountName|background-vars-userInfo|configmap-context-lookup)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^cel$/^(cel-preconditions|cel-variables|check-statefulset-namespace|deny|disallow-host-port)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^cel-deprecated$/^(cel-preconditions|cel-variables|check-statefulset-namespace|disallow-host-port)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^cel-deprecated$/^authorizor-checks$/^(with-permissions|without-permissions)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^cel-deprecated$/^parameter-resources$/^(clusterscoped)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^cel-deprecated$/^parameter-resources$/^namespaced$/^(match-clusterscoped-resource|set-paramref-namespace|unset-paramref-namespace)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^cel$/^authorizor-checks$/^(with-permissions|without-permissions)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^cel$/^parameter-resources$/^(clusterscoped)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^cel$/^parameter-resources$/^namespaced$/^(match-clusterscoped-resource|set-paramref-namespace|unset-paramref-namespace)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^debug$/^(with-pod|with-subresource|with-wildcard)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^debug-deprecated$/^(with-pod|with-subresource|with-wildcard)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^enforce$/^(api-initiated-pod-eviction|block-pod-exec-requests|bypass-with-policy-exception|csr|enforce-validate-existing|failure-policy-ignore-anchor|ns-selector-with-wildcard-kind|operator-allnotin-01|operator-anyin-boolean|resource-apply-block|scaling-with-kubectl-scale)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^enforce-deprecated$/^(api-initiated-pod-eviction|block-pod-exec-requests|bypass-with-policy-exception|csr|enforce-validate-existing|failure-policy-ignore-anchor|ns-selector-with-wildcard-kind|operator-allnotin-01|operator-anyin-boolean|resource-apply-block|scaling-with-kubectl-scale)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^exclude$/^(exclude-namespace|exclude-namespace(deprecated))\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^operations$/^(only-update|only-update(deprecated))\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^psa$/^(concurrent-policy-execution|seccomp-latest-check-no-exclusion|test-deletion-request|test-exclusion-capabilities|test-exclusion-host-namespaces|test-exclusion-host-ports|test-exclusion-hostpath-volume|test-exclusion-hostprocesses|test-exclusion-privilege-escalation|test-exclusion-privileged-containers|test-exclusion-restricted-capabilities|test-exclusion-restricted-seccomp)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^psa$/^(test-exclusion-running-as-nonroot|test-exclusion-running-as-nonroot-user|test-exclusion-seccomp|test-exclusion-selinux|test-exclusion-sysctls|test-exclusion-volume-types)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^psa-deprecated$/^(seccomp-latest-check-no-exclusion|test-deletion-request|test-exclusion-capabilities|test-exclusion-host-namespaces|test-exclusion-host-ports|test-exclusion-hostpath-volume|test-exclusion-hostprocesses|test-exclusion-privilege-escalation|test-exclusion-privileged-containers|test-exclusion-restricted-capabilities|test-exclusion-restricted-seccomp|test-exclusion-running-as-nonroot)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^psa-deprecated$/^(test-exclusion-running-as-nonroot-user|test-exclusion-seccomp|test-exclusion-selinux|test-exclusion-sysctls|test-exclusion-volume-types)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^variables$/^lazyload$/^(conditions|conditions-deprecated)\\[.*\\]$", + "^validate$/^clusterpolicy$/^standard$/^wildcard$/^(block-verifyimage|block-verifyimage-deprecated)\\[.*\\]$", + "^validate$/^e2e$/^(adding-key-to-config-map|adding-key-to-config-map-deprecated|global-anchor|global-anchor-deprecated|lowercase-kind-crd|lowercase-kind-crd-deprecated|old-object-exists|old-object-exists-deprecated|trusted-images|trusted-images-deprecated|x509-decode|x509-decode-deprecated)\\[.*\\]$", + "^validate$/^e2e$/^(yaml-signing|yaml-signing-deprecated)\\[.*\\]$" + ], + "validating-admission-policy-reports": [ + "^validating-admission-policy-reports$/^(events)\\[.*\\]$", + "^validating-admission-policy-reports$/^background$/^(validating-admission-policy-fail|validating-admission-policy-pass|with-validating-admission-policy-binding-fail|with-validating-admission-policy-binding-no-reports|with-validating-admission-policy-binding-pass)\\[.*\\]$" + ], + "verify-manifests": [ + "^verify-manifests$/^(multi-signatures|multi-signatures(deprecated)|single-signature|single-signature(deprecated))\\[.*\\]$" + ], + "verifyImages": [ + "^verifyImages$/^clusterpolicy$/^cornercases$/^(multiple-attestors)\\[.*\\]$", + "^verifyImages$/^clusterpolicy$/^standard$/^(configmap-context-lookup|empty-image|failure-policy-test-noconfigmap-diffimage-success|failure-policy-test-noconfigmap-diffimage-success-deprecated|imageExtractors-complex|imageExtractors-complex-keyless|imageExtractors-none|imageExtractors-simple|keyed-basic|keyed-basic-namespace-selector|keyed-oci11|keyed-secret)\\[.*\\]$", + "^verifyImages$/^clusterpolicy$/^standard$/^(keyed-tsa|keyless-attestation-invalid-attestor|keyless-attestation-regexp|keyless-attestations-multiple-subjects-1|keyless-attestations-multiple-subjects-2|keyless-attestations-multiple-subjects-3|keyless-attestations-multiple-subjects-4|keyless-attestations-multiple-subjects-counts-1|keyless-attestations-multiple-subjects-counts-2|keyless-attestations-multiple-subjects-counts-3|keyless-image-invalid-attestor|keyless-mutatedigest-verifydigest-required)\\[.*\\]$", + "^verifyImages$/^clusterpolicy$/^standard$/^(keyless-nomutatedigest-noverifydigest-norequired|keyless-nomutatedigest-noverifydigest-required|mutateDigest-noverifyDigest-norequired|noconfigmap-diffimage-success|nomutateDigest-verifyDigest-norequired|notary-attestation-verification|notary-image-verification|notary-image-verification-secret-from-policy|rollback-image-verification|sigstore-attestation-verification-regexp|sigstore-attestation-verification-test|sigstore-image-verification-test)\\[.*\\]$", + "^verifyImages$/^clusterpolicy$/^standard$/^(skip-image-reference|update-multi-containers|verify-image-background-audit|verify-image-background-basic|verify-image-background-existing|with-mutation)\\[.*\\]$" + ], + "webhook-configurations": [ + "^webhook-configurations$/^(cpol-match-conditions-block|cpol-match-conditions-pass|match-conditions-standard|match-conditions-userinfo|webhook-registeration)\\[.*\\]$" + ], + "webhooks": [ + "^webhooks$/^(all-scale|clusterpolicy|double-wildcard|dyn-op-mutate|dyn-op-mutate-multiple|dyn-op-validate|dyn-op-validate-and-mutate|dyn-op-validate-multiple|expected-webhooks|only-pod|pod-all-subresources|pod-exec-subresource)\\[.*\\]$", + "^webhooks$/^(policy|policy-clusterpolicy-different-resource-group|policy-clusterpolicy-namespaced-clusterscoped-resources|policy-clusterpolicy-namespaced-resources|policy-clusterpolicy-same-resource|policy-clusterpolicy-wildcard-resource|policy-clusterscope-resource|policy-different-resource-group|policy-wildcard-resource|scale|unknown-kind)\\[.*\\]$" + ] +} diff --git a/.github/workflows/conformance.yaml b/.github/workflows/conformance.yaml index 60612321a7..8c53e00c12 100644 --- a/.github/workflows/conformance.yaml +++ b/.github/workflows/conformance.yaml @@ -15,6 +15,17 @@ concurrency: cancel-in-progress: true jobs: + define-matrix: + runs-on: ubuntu-latest + outputs: + tests: ${{ steps.tests.outputs.tests }} + steps: + - name: Checkout + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + - name: Set matrix data + id: tests + run: echo "tests=$(jq -c . < ./.github/e2e-matrix.json)" >> $GITHUB_OUTPUT + prepare-images: runs-on: ubuntu-latest steps: @@ -81,36 +92,34 @@ jobs: fail-fast: false matrix: k8s-version: - - v1.28.13 - - v1.29.8 - - v1.30.4 + # - v1.28.13 + # - v1.29.8 + # - v1.30.4 - v1.31.0 tests: - - ^assert$ - - ^autogen$ - - ^background-only$ - - ^cleanup$ - - ^deferred$ - - ^events$ - - ^exceptions$ - - ^filter$ - - ^generate$/^clusterpolicy$ - - ^generate$/^policy$ - - ^generate$/^validation$ - - ^generate$/^foreach$ - - ^globalcontext$ - - ^lease$ - - ^mutate$ - - ^policy-validation$ - - ^rangeoperators$ - - ^rbac$ - - ^reports$ - - ^validate$ - - ^verify-manifests$ - - ^verifyImages$ - - ^webhooks$ + - ${{ fromJSON(needs.define-matrix.outputs.tests).assert }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).autogen }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).background-only }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).cleanup }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).deferred }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).events }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).exceptions }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).filter }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).generate }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).globalcontext }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).lease }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).mutate }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).policy-validation }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).rangeoperators }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).rbac }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).reports }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).validate }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).verify-manifests }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).verifyImages }} + - ${{ fromJSON(needs.define-matrix.outputs.tests).webhooks }} needs: - prepare-images + - define-matrix steps: - name: Checkout uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7