mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-15 17:51:20 +00:00
Code Activity
kyverno/test/conformance/chainsaw/exceptions/exclude-restricted-capabilities
History
Mariam Fahmy b7bf894fe9
chore: use v2 for exceptions in chainsaw tests (#10529) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-06-24 11:54:57 +00:00
..
chainsaw-test.yaml feat: add chainsaw tests for pod security in exceptions (#9667) 2024-02-06 13:07:58 +00:00
exception.yaml chore: use v2 for exceptions in chainsaw tests (#10529) 2024-06-24 11:54:57 +00:00
ns.yaml feat: add chainsaw tests for pod security in exceptions (#9667) 2024-02-06 13:07:58 +00:00
pod-allowed-1.yaml feat: add chainsaw tests for pod security in exceptions (#9667) 2024-02-06 13:07:58 +00:00
pod-allowed-2.yaml feat: add chainsaw tests for pod security in exceptions (#9667) 2024-02-06 13:07:58 +00:00
pod-rejected-1.yaml feat: add chainsaw tests for pod security in exceptions (#9667) 2024-02-06 13:07:58 +00:00
pod-rejected-2.yaml feat: add chainsaw tests for pod security in exceptions (#9667) 2024-02-06 13:07:58 +00:00
pod-rejected-3.yaml feat: add chainsaw tests for pod security in exceptions (#9667) 2024-02-06 13:07:58 +00:00
pod-rejected-4.yaml feat: add chainsaw tests for pod security in exceptions (#9667) 2024-02-06 13:07:58 +00:00
policy-assert.yaml feat: add chainsaw tests for pod security in exceptions (#9667) 2024-02-06 13:07:58 +00:00
policy.yaml feat: add chainsaw tests for pod security in exceptions (#9667) 2024-02-06 13:07:58 +00:00
README.md feat: add chainsaw tests for pod security in exceptions (#9667) 2024-02-06 13:07:58 +00:00

README.md

Description

This test creates a policy that enforces the restricted profile and a policy exception that exempts any pod whose image is nginx in the staging-ns namespace and fields:

  1. spec.containers[*].securityContext.capabilities.add is set to foo.
  2. spec.initContainers[*].securityContext.capabilities.add is set to baz.

Steps

    • Create a cluster policy
    • Assert the policy becomes ready
    • Create a policy exception for the cluster policy created above.
    • Try to create a pod named good-pod-1 in the default namespace with spec.containers[*].securityContext.capabilities.add set to NET_BIND_SERVICE, expecting the creation to succeed.
    • Try to create a pod named good-pod-2 whose image is nginx in the staging-ns namespace with spec.containers[*].securityContext.capabilities.add set to foo and spec.initContainers[*].securityContext.capabilities.add set to baz, expecting the creation to succeed.
    • Try to create a pod named bad-pod-1 whose image is nginx in the staging-ns namespace with spec.containers[*].securityContext.capabilities.add set to baz and spec.initContainers[*].securityContext.capabilities.add set to foo, expecting the creation to fail.
    • Try to create a pod named bad-pod-2 whose image is busybox in the staging-ns namespace with spec.containers[*].securityContext.capabilities.add set to foo and spec.initContainers[*].securityContext.capabilities.add set to baz, expecting the creation to fail.
    • Try to create a pod named bad-pod-3 whose image is nginx in the staging-ns namespace with spec.containers[*].securityContext.capabilities.add set to foo and spec.ephemeralContainers[*].securityContext.capabilities.add set to baz, expecting the creation to fail.
    • Try to create a pod named bad-pod-4 whose image is nginx in the default namespace with spec.containers[*].securityContext.capabilities.add set to foo and spec.initContainers[*].securityContext.capabilities.add set to baz, expecting the creation to fail.