mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-31 03:45:17 +00:00
Code Activity
kyverno/test/conformance/chainsaw/exceptions/exclude-sysctls
History
Charles-Edouard Brétéché df267dd829
chore: use more chainsaw step templates (#11311) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-10-03 11:56:30 +00:00
..
chainsaw-test.yaml chore: use more chainsaw step templates (#11311) 2024-10-03 11:56:30 +00:00
exception.yaml
ns.yaml
pod-allowed-1.yaml
pod-allowed-2.yaml
pod-rejected-1.yaml
pod-rejected-2.yaml
policy.yaml chore: rename validationFailureAction to failureAction under the rule (#10893) 2024-08-27 20:07:57 +00:00
README.md

README.md

Description

This test creates a policy that enforces the baseline profile and a policy exception that exempts any pod whose namespace is staging-ns namespace and sets the spec.securityContext.sysctls[*].name to fake.value.

Steps

    • Create a cluster policy
    • Assert the policy becomes ready
    • Create a policy exception for the cluster policy created above.
    • Try to create a pod named good-pod-1 in the default namespace whose spec.securityContext.sysctls[0].name field is set to net.ipv4.ip_unprivileged_port_start, expecting the creation to succeed.
    • Try to create a pod named good-pod-2 in the staging-ns namespace whose spec.securityContext.sysctls[0].name field is set to fake.value, expecting the creation to succeed.
    • Try to create a pod named bad-pod-1 in the staging-ns namespace whose spec.securityContext.sysctls[0].name field is set to unknown, expecting the creation to fail.
    • Try to create a pod named bad-pod-2 in the default namespace whose spec.securityContext.sysctls[0].name field is set to fake.value, expecting the creation to fail.