mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-06 16:06:56 +00:00
e0f617b383
* add watch policy to clusterrole kyverno:customresources * - improve auto-gen policy application logic - remove unused code * move method to common util * auto-gen rule for cronJob * update doc * set CronJob as default auto-gen pod controller * - update doc; - fix test * remove unused code
114 lines
3.7 KiB
Go
114 lines
3.7 KiB
Go
package policymutation
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/nirmata/kyverno/pkg/engine"
|
|
"github.com/nirmata/kyverno/pkg/utils"
|
|
"gotest.tools/assert"
|
|
"sigs.k8s.io/controller-runtime/pkg/log"
|
|
)
|
|
|
|
func currentDir() (string, error) {
|
|
homedir, err := os.UserHomeDir()
|
|
if err != nil {
|
|
return "", nil
|
|
}
|
|
|
|
return filepath.Join(homedir, "github.com/nirmata/kyverno"), nil
|
|
}
|
|
|
|
func Test_CronJobOnly(t *testing.T) {
|
|
|
|
controllers := engine.PodControllerCronJob
|
|
dir, err := os.Getwd()
|
|
baseDir := filepath.Dir(filepath.Dir(dir))
|
|
assert.NilError(t, err)
|
|
|
|
policies, errs := utils.GetPolicy(baseDir + "/samples/best_practices/disallow_bind_mounts.yaml")
|
|
if len(errs) != 0 {
|
|
t.Log(errs)
|
|
}
|
|
|
|
policy := policies[0]
|
|
policy.SetAnnotations(map[string]string{
|
|
engine.PodControllersAnnotation: controllers,
|
|
})
|
|
|
|
rulePatches, errs := generateRulePatches(*policy, controllers, log.Log)
|
|
if len(errs) != 0 {
|
|
t.Log(errs)
|
|
}
|
|
|
|
expectedPatches := [][]byte{
|
|
[]byte(`{"path":"/spec/rules/1","op":"add","value":{"name":"autogen-cronjob-validate-hostPath","match":{"resources":{"kinds":["CronJob"]}},"validate":{"message":"Host path volumes are not allowed","pattern":{"spec":{"jobTemplate":{"spec":{"template":{"spec":{"=(volumes)":[{"X(hostPath)":null}]}}}}}}}}}`),
|
|
}
|
|
|
|
assert.DeepEqual(t, rulePatches, expectedPatches)
|
|
}
|
|
|
|
func Test_CronJob_hasExclude(t *testing.T) {
|
|
|
|
controllers := engine.PodControllerCronJob
|
|
dir, err := os.Getwd()
|
|
baseDir := filepath.Dir(filepath.Dir(dir))
|
|
assert.NilError(t, err)
|
|
|
|
policies, errs := utils.GetPolicy(baseDir + "/samples/best_practices/disallow_bind_mounts.yaml")
|
|
if len(errs) != 0 {
|
|
t.Log(errs)
|
|
}
|
|
|
|
policy := policies[0]
|
|
policy.SetAnnotations(map[string]string{
|
|
engine.PodControllersAnnotation: controllers,
|
|
})
|
|
|
|
rule := policy.Spec.Rules[0].DeepCopy()
|
|
rule.ExcludeResources.Kinds = []string{"Pod"}
|
|
rule.ExcludeResources.Namespaces = []string{"test"}
|
|
policy.Spec.Rules[0] = *rule
|
|
|
|
rulePatches, errs := generateRulePatches(*policy, controllers, log.Log)
|
|
if len(errs) != 0 {
|
|
t.Log(errs)
|
|
}
|
|
|
|
expectedPatches := [][]byte{
|
|
[]byte(`{"path":"/spec/rules/1","op":"add","value":{"name":"autogen-cronjob-validate-hostPath","match":{"resources":{"kinds":["CronJob"]}},"exclude":{"resources":{"kinds":["CronJob"],"namespaces":["test"]}},"validate":{"message":"Host path volumes are not allowed","pattern":{"spec":{"jobTemplate":{"spec":{"template":{"spec":{"=(volumes)":[{"X(hostPath)":null}]}}}}}}}}}`),
|
|
}
|
|
|
|
assert.DeepEqual(t, rulePatches, expectedPatches)
|
|
}
|
|
|
|
func Test_CronJobAndDeployment(t *testing.T) {
|
|
controllers := strings.Join([]string{engine.PodControllerCronJob, "Deployment"}, ",")
|
|
dir, err := os.Getwd()
|
|
baseDir := filepath.Dir(filepath.Dir(dir))
|
|
assert.NilError(t, err)
|
|
|
|
policies, errs := utils.GetPolicy(baseDir + "/samples/best_practices/disallow_bind_mounts.yaml")
|
|
if len(errs) != 0 {
|
|
t.Log(errs)
|
|
}
|
|
|
|
policy := policies[0]
|
|
policy.SetAnnotations(map[string]string{
|
|
engine.PodControllersAnnotation: controllers,
|
|
})
|
|
|
|
rulePatches, errs := generateRulePatches(*policy, controllers, log.Log)
|
|
if len(errs) != 0 {
|
|
t.Log(errs)
|
|
}
|
|
|
|
expectedPatches := [][]byte{
|
|
[]byte(`{"path":"/spec/rules/1","op":"add","value":{"name":"autogen-validate-hostPath","match":{"resources":{"kinds":["Deployment"]}},"validate":{"message":"Host path volumes are not allowed","pattern":{"spec":{"template":{"spec":{"=(volumes)":[{"X(hostPath)":null}]}}}}}}}`),
|
|
[]byte(`{"path":"/spec/rules/2","op":"add","value":{"name":"autogen-cronjob-validate-hostPath","match":{"resources":{"kinds":["CronJob"]}},"validate":{"message":"Host path volumes are not allowed","pattern":{"spec":{"jobTemplate":{"spec":{"template":{"spec":{"=(volumes)":[{"X(hostPath)":null}]}}}}}}}}}`),
|
|
}
|
|
|
|
assert.DeepEqual(t, rulePatches, expectedPatches)
|
|
}
|