mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-10 18:06:55 +00:00
Code Activity
kyverno/test/conformance/chainsaw/exceptions/exclude-seccomp
History
Mariam Fahmy c796bb765c
fix: return policies with either audit or enforce rules from the cache (#10667) 
* fix: return policies with either audit or enforce rules from the cache

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: introduce validationFailureAction under verifyImage rules

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add chainsaw tests

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2024-08-06 18:24:28 +00:00
..
chainsaw-test.yaml
exception.yaml chore: use v2 for exceptions in chainsaw tests (#10529) 2024-06-24 11:54:57 +00:00
ns.yaml
pod-allowed-1.yaml
pod-allowed-2.yaml
pod-rejected-1.yaml
pod-rejected-2.yaml
policy-assert.yaml
policy.yaml fix: return policies with either audit or enforce rules from the cache (#10667) 2024-08-06 18:24:28 +00:00
README.md

README.md

Description

This test creates a policy that enforces the baseline profile and a policy exception that exempts any pod in the staging-ns namespace and sets the spec.securityContext.seccompProfile.type to Unconfined.

Steps

    • Create a cluster policy
    • Assert the policy becomes ready
    • Create a policy exception for the cluster policy created above.
    • Try to create a pod named good-pod-1 in the default namespace that doesn't violate the baseline profile, expecting the creation to succeed.
    • Try to create a pod named good-pod-2 in the staging-ns namespace and the spec.securityContext.seccompProfile.type is set to Unconfined and the spec.containers[*].securityContext.seccompProfile.type is set to RuntimeDefault, expecting the creation to succeed.
    • Try to create a pod named bad-pod-1 in the staging-ns namespace and the spec.securityContext.seccompProfile.type is set to Unconfined and the spec.containers[*].securityContext.seccompProfile.type is set to Unconfined, expecting the creation to fail.
    • Try to create a pod named bad-pod-2 in the default namespace and the spec.securityContext.seccompProfile.type is set to Unconfined and the spec.containers[*].securityContext.seccompProfile.type is set to Unconfined, expecting the creation to fail.