41 lines
1 KiB
YAML
41 lines
1 KiB
YAML
|
apiVersion: cli.kyverno.io/v1alpha1
|
||
|
|
kind: Test
|
||
|
|
metadata:
|
||
|
|
name: restrict-zot-image-pulls
|
||
|
|
policies:
|
||
|
|
- ../../policies/restrict-zot-image-pulls.yaml
|
||
|
|
resources:
|
||
|
|
- resources.yaml
|
||
|
|
results:
|
||
|
|
- policy: restrict-zot-image-pulls
|
||
|
|
rule: deny-unapproved-zot-images
|
||
|
|
kind: Pod
|
||
|
|
resources:
|
||
|
|
- allowed-quay-bootstrap
|
||
|
|
- allowed-postgres
|
||
|
|
- allowed-non-zot
|
||
|
|
result: pass
|
||
|
|
- policy: restrict-zot-image-pulls
|
||
|
|
rule: deny-unapproved-zot-images
|
||
|
|
kind: Pod
|
||
|
|
resources:
|
||
|
|
- blocked-container
|
||
|
|
- blocked-init-container
|
||
|
|
- blocked-ephemeral-container
|
||
|
|
- blocked-quay-lookalike
|
||
|
|
- blocked-postgres-lookalike
|
||
|
|
- blocked-explicit-port
|
||
|
|
- blocked-uppercase-host
|
||
|
|
result: fail
|
||
|
|
- policy: restrict-zot-image-pulls
|
||
|
|
rule: autogen-deny-unapproved-zot-images
|
||
|
|
kind: Deployment
|
||
|
|
resources:
|
||
|
|
- blocked-deployment
|
||
|
|
result: fail
|
||
|
|
- policy: restrict-zot-image-pulls
|
||
|
|
rule: autogen-cronjob-deny-unapproved-zot-images
|
||
|
|
kind: CronJob
|
||
|
|
resources:
|
||
|
|
- blocked-cronjob
|
||
|
|
result: fail
|