mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-09 17:37:12 +00:00
Code Activity
kyverno/test/conformance/chainsaw/exceptions/exclude-capabilities
History
Charles-Edouard Brétéché 5a0ce6bb67
chore: bump chainsaw (#11161) 
* chore: bump chainsaw

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* more template use

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* v0.2.10

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* go mod

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-09-17 09:28:33 +00:00
..
chainsaw-test.yaml chore: bump chainsaw (#11161) 2024-09-17 09:28:33 +00:00
exception.yaml chore: use v2 for exceptions in chainsaw tests (#10529) 2024-06-24 11:54:57 +00:00
ns.yaml feat: support podSecurity exclusion in exceptions (#9343) 2024-01-26 18:43:07 +00:00
pod-allowed.yaml feat: support podSecurity exclusion in exceptions (#9343) 2024-01-26 18:43:07 +00:00
pod-rejected-1.yaml feat: support podSecurity exclusion in exceptions (#9343) 2024-01-26 18:43:07 +00:00
pod-rejected-2.yaml feat: support podSecurity exclusion in exceptions (#9343) 2024-01-26 18:43:07 +00:00
policy-assert.yaml feat: support podSecurity exclusion in exceptions (#9343) 2024-01-26 18:43:07 +00:00
policy.yaml chore: rename validationFailureAction to failureAction under the rule (#10893) 2024-08-27 20:07:57 +00:00
README.md feat: support podSecurity exclusion in exceptions (#9343) 2024-01-26 18:43:07 +00:00

README.md

Description

This test creates a policy that enforces the restricted profile and a policy exception that exempts containers running either the nginx or redis image from the Capabilities control. The policy exception is configured to apply only to the pods that in staging-ns namespace.

Steps

    • Create a cluster policy
    • Assert the policy becomes ready
    • Create a policy exception for the cluster policy created above.
    • Try to create a pod named goodpod01 whose image is nginx in the staging-ns namespace that violates the policy, expecting the creation to succeed
    • Try to create a pod named badpod01 whose image is nginx in the default namespace that violates the policy, expecting the creation to fail
    • Try to create a pod named badpod02 whose image is busybox in the staging-ns namespace that violates the policy,, expecting the creation to fail