mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-14 11:57:48 +00:00
Code Activity

chore: run background-only tests with chainsaw (#8943)

Browse source 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
This commit is contained in:
Mariam Fahmy 2023-11-19 03:30:42 +02:00 committed by GitHub
parent dcea5b084d
commit fc841c0417
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
48 changed files with 473 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
.github/workflows/conformance.yaml vendored
View file

@ -196,6 +196,7 @@ jobs:
# - verify-manifests
# - verifyImages
- webhooks
- background-only
needs: prepare-images
name: chainsaw - ${{ matrix.k8s-version.name }} - ${{ matrix.config.name }} - ${{ matrix.tests }}
steps:

3
test/conformance/chainsaw/_config/common.yaml
View file

@ -3,6 +3,9 @@ kind: Configuration
metadata:
name: congiguration
spec:
timeouts:
assert: 90s
error: 90s
parallel: 1
fullName: true
failFast: true

10
test/conformance/chainsaw/background-only/cluster-policy/no-admission-event/01-policy.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
name: policy
spec:
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml

8
test/conformance/chainsaw/background-only/cluster-policy/no-admission-event/02-resource.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
name: resource
spec:
try:
- apply:
file: resource.yaml

12
test/conformance/chainsaw/background-only/cluster-policy/no-admission-event/03-event.yaml Normal file
View file

@ -0,0 +1,12 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
name: event
spec:
try:
- assert:
file: background-event.yaml
- error:
file: admission-event.yaml
catch:
- events: {}

10
test/conformance/chainsaw/background-only/cluster-policy/no-admission-event/README.md Normal file
View file

@ -0,0 +1,10 @@
## Description
This test creates a policy with `admission` set to `false`.
Then it creates a resource that violates the policy.
## Expected Behavior
The resource creates fine as the policy doesn't apply at admission time.
No admission ezvent is created.
One background event is created.

8
test/conformance/chainsaw/background-only/cluster-policy/no-admission-event/admission-event.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: v1
involvedObject:
apiVersion: v1
kind: Pod
name: pod
kind: Event
metadata: {}
reportingComponent: kyverno-admission

8
test/conformance/chainsaw/background-only/cluster-policy/no-admission-event/background-event.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: v1
involvedObject:
apiVersion: v1
kind: Pod
name: pod
kind: Event
metadata: {}
reportingComponent: kyverno-scan

10
test/conformance/chainsaw/background-only/cluster-policy/no-admission-event/policy-assert.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: validate
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

17
test/conformance/chainsaw/background-only/cluster-policy/no-admission-event/policy.yaml Normal file
View file

@ -0,0 +1,17 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: validate
spec:
validationFailureAction: Enforce
admission: false
background: true
rules:
- name: validate
match:
any:
- resources:
kinds:
- Pod
validate:
deny: {}

10
test/conformance/chainsaw/background-only/cluster-policy/no-admission-event/resource.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: v1
kind: Pod
metadata:
name: pod
spec:
containers:
- name: container
image: nginx:latest
ports:
- containerPort: 80

10
test/conformance/chainsaw/background-only/cluster-policy/no-admission-report/01-policy.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
name: policy
spec:
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml

8
test/conformance/chainsaw/background-only/cluster-policy/no-admission-report/02-resource.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
name: resource
spec:
try:
- apply:
file: resource.yaml

8
test/conformance/chainsaw/background-only/cluster-policy/no-admission-report/03-report.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
name: report
spec:
try:
- error:
file: admission-report.yaml

9
test/conformance/chainsaw/background-only/cluster-policy/no-admission-report/README.md Normal file
View file

@ -0,0 +1,9 @@
## Description
This test creates a policy with `admission` set to `false`.
Then it creates a resource that violates the policy.
## Expected Behavior
The resource creates fine as the policy doesn't apply at admission time.
No admission report is created.

7
test/conformance/chainsaw/background-only/cluster-policy/no-admission-report/admission-report.yaml Normal file
View file

@ -0,0 +1,7 @@
apiVersion: kyverno.io/v1alpha2
kind: AdmissionReport
metadata:
ownerReferences:
- apiVersion: v1
kind: Pod
name: pod

10
test/conformance/chainsaw/background-only/cluster-policy/no-admission-report/policy-assert.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: validate
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

17
test/conformance/chainsaw/background-only/cluster-policy/no-admission-report/policy.yaml Normal file
View file

@ -0,0 +1,17 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: validate
spec:
validationFailureAction: Enforce
admission: false
background: true
rules:
- name: validate
match:
any:
- resources:
kinds:
- Pod
validate:
deny: {}

10
test/conformance/chainsaw/background-only/cluster-policy/no-admission-report/resource.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: v1
kind: Pod
metadata:
name: pod
spec:
containers:
- name: container
image: nginx:latest
ports:
- containerPort: 80

10
test/conformance/chainsaw/background-only/cluster-policy/not-rejected/01-policy.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
name: policy
spec:
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml

8
test/conformance/chainsaw/background-only/cluster-policy/not-rejected/02-resource.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
name: resource
spec:
try:
- apply:
file: resource.yaml

8
test/conformance/chainsaw/background-only/cluster-policy/not-rejected/README.md Normal file
View file

@ -0,0 +1,8 @@
## Description
This test creates a policy with `admission` set to `false`.
Then it creates a resource that violates the policy.
## Expected Behavior
The resource creates fine as the policy doesn't apply at admission time.

10
test/conformance/chainsaw/background-only/cluster-policy/not-rejected/policy-assert.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: validate
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

17
test/conformance/chainsaw/background-only/cluster-policy/not-rejected/policy.yaml Normal file
View file

@ -0,0 +1,17 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: validate
spec:
validationFailureAction: Enforce
admission: false
background: true
rules:
- name: validate
match:
any:
- resources:
kinds:
- Pod
validate:
deny: {}

10
test/conformance/chainsaw/background-only/cluster-policy/not-rejected/resource.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: v1
kind: Pod
metadata:
name: pod
spec:
containers:
- name: container
image: nginx:latest
ports:
- containerPort: 80

10
test/conformance/chainsaw/background-only/policy/no-admission-event/01-policy.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
name: policy
spec:
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml

8
test/conformance/chainsaw/background-only/policy/no-admission-event/02-resource.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
name: resource
spec:
try:
- apply:
file: resource.yaml

10
test/conformance/chainsaw/background-only/policy/no-admission-event/03-event.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
name: event
spec:
try:
- assert:
file: background-event.yaml
- error:
file: admission-event.yaml

10
test/conformance/chainsaw/background-only/policy/no-admission-event/README.md Normal file
View file

@ -0,0 +1,10 @@
## Description
This test creates a policy with `admission` set to `false`.
Then it creates a resource that violates the policy.
## Expected Behavior
The resource creates fine as the policy doesn't apply at admission time.
No admission ezvent is created.
One background event is created.

8
test/conformance/chainsaw/background-only/policy/no-admission-event/admission-event.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: v1
involvedObject:
apiVersion: v1
kind: Pod
name: pod
kind: Event
metadata: {}
reportingComponent: kyverno-admission

8
test/conformance/chainsaw/background-only/policy/no-admission-event/background-event.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: v1
involvedObject:
apiVersion: v1
kind: Pod
name: pod
kind: Event
metadata: {}
reportingComponent: kyverno-scan

10
test/conformance/chainsaw/background-only/policy/no-admission-event/policy-assert.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: kyverno.io/v1
kind: Policy
metadata:
name: validate
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

17
test/conformance/chainsaw/background-only/policy/no-admission-event/policy.yaml Normal file
View file

@ -0,0 +1,17 @@
apiVersion: kyverno.io/v1
kind: Policy
metadata:
name: validate
spec:
validationFailureAction: Enforce
admission: false
background: true
rules:
- name: validate
match:
any:
- resources:
kinds:
- Pod
validate:
deny: {}

10
test/conformance/chainsaw/background-only/policy/no-admission-event/resource.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: v1
kind: Pod
metadata:
name: pod
spec:
containers:
- name: container
image: nginx:latest
ports:
- containerPort: 80

10
test/conformance/chainsaw/background-only/policy/no-admission-report/01-policy.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
name: policy
spec:
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml

8
test/conformance/chainsaw/background-only/policy/no-admission-report/02-resource.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
name: resource
spec:
try:
- apply:
file: resource.yaml

8
test/conformance/chainsaw/background-only/policy/no-admission-report/03-report.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
name: report
spec:
try:
- error:
file: admission-report.yaml

9
test/conformance/chainsaw/background-only/policy/no-admission-report/README.md Normal file
View file

@ -0,0 +1,9 @@
## Description
This test creates a policy with `admission` set to `false`.
Then it creates a resource that violates the policy.
## Expected Behavior
The resource creates fine as the policy doesn't apply at admission time.
No admission report is created.

7
test/conformance/chainsaw/background-only/policy/no-admission-report/admission-report.yaml Normal file
View file

@ -0,0 +1,7 @@
apiVersion: kyverno.io/v1alpha2
kind: AdmissionReport
metadata:
ownerReferences:
- apiVersion: v1
kind: Pod
name: pod

10
test/conformance/chainsaw/background-only/policy/no-admission-report/policy-assert.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: kyverno.io/v1
kind: Policy
metadata:
name: validate
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

17
test/conformance/chainsaw/background-only/policy/no-admission-report/policy.yaml Normal file
View file

@ -0,0 +1,17 @@
apiVersion: kyverno.io/v1
kind: Policy
metadata:
name: validate
spec:
validationFailureAction: Enforce
admission: false
background: true
rules:
- name: validate
match:
any:
- resources:
kinds:
- Pod
validate:
deny: {}

10
test/conformance/chainsaw/background-only/policy/no-admission-report/resource.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: v1
kind: Pod
metadata:
name: pod
spec:
containers:
- name: container
image: nginx:latest
ports:
- containerPort: 80

10
test/conformance/chainsaw/background-only/policy/not-rejected/01-policy.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
name: policy
spec:
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml

9
test/conformance/chainsaw/background-only/policy/not-rejected/02-resource.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: TestStep
metadata:
creationTimestamp: null
name: resource
spec:
try:
- apply:
file: resource.yaml

8
test/conformance/chainsaw/background-only/policy/not-rejected/README.md Normal file
View file

@ -0,0 +1,8 @@
## Description
This test creates a policy with `admission` set to `false`.
Then it creates a resource that violates the policy.
## Expected Behavior
The resource creates fine as the policy doesn't apply at admission time.

10
test/conformance/chainsaw/background-only/policy/not-rejected/policy-assert.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: kyverno.io/v1
kind: Policy
metadata:
name: validate
spec: {}
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

17
test/conformance/chainsaw/background-only/policy/not-rejected/policy.yaml Normal file
View file

@ -0,0 +1,17 @@
apiVersion: kyverno.io/v1
kind: Policy
metadata:
name: validate
spec:
validationFailureAction: Enforce
admission: false
background: true
rules:
- name: validate
match:
any:
- resources:
kinds:
- Pod
validate:
deny: {}

10
test/conformance/chainsaw/background-only/policy/not-rejected/resource.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: v1
kind: Pod
metadata:
name: pod
spec:
containers:
- name: container
image: nginx:latest
ports:
- containerPort: 80