ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
37 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

130
vendor/platform/kyverno/tests/baseline/kyverno-test.yaml vendored Normal file
View file

@ -0,0 +1,130 @@
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
name: baseline-enforce
policies:
- ../../policies/require-app-labels.yaml
- ../../policies/deny-latest-tag.yaml
- ../../policies/deny-privileged.yaml
- ../../policies/require-drop-all-capabilities.yaml
- ../../policies/require-allow-privilege-escalation-false.yaml
- ../../policies/require-resource-requests.yaml
resources:
- resources.yaml
results:
- policy: require-app-labels
rule: require-app-name-and-instance
kind: Pod
resources:
- good-pod
result: pass
- policy: deny-latest-tag
rule: deny-latest-images
kind: Pod
resources:
- good-pod
result: pass
- policy: deny-privileged
rule: deny-privileged-containers
kind: Pod
resources:
- good-pod
result: pass
- policy: require-drop-all-capabilities
rule: require-capabilities-drop-all
kind: Pod
resources:
- good-pod
result: pass
- policy: require-allow-privilege-escalation-false
rule: require-allow-privilege-escalation-false
kind: Pod
resources:
- good-pod
result: pass
- policy: require-resource-requests
rule: require-cpu-memory-requests
kind: Pod
resources:
- good-pod
result: pass
- policy: require-resource-requests
rule: require-cpu-memory-requests
kind: Pod
resources:
- debug-ephemeral-container
result: pass
- policy: require-app-labels
rule: require-app-name-and-instance
kind: Pod
resources:
- bad-labels
result: fail
- policy: deny-latest-tag
rule: deny-latest-images
kind: Pod
resources:
- bad-latest
result: fail
- policy: deny-privileged
rule: deny-privileged-containers
kind: Pod
resources:
- bad-privileged
result: fail
- policy: require-drop-all-capabilities
rule: require-capabilities-drop-all
kind: Pod
resources:
- bad-caps
result: fail
- policy: require-allow-privilege-escalation-false
rule: require-allow-privilege-escalation-false
kind: Pod
resources:
- bad-ape
result: fail
- policy: require-resource-requests
rule: require-cpu-memory-requests
kind: Pod
resources:
- bad-requests
result: fail
- policy: require-app-labels
rule: require-app-name-and-instance
kind: Pod
resources:
- excluded-ns
result: skip
- policy: deny-latest-tag
rule: deny-latest-images
kind: Pod
resources:
- excluded-ns
result: skip
- policy: deny-privileged
rule: deny-privileged-containers
kind: Pod
resources:
- excluded-ns
result: skip
- policy: require-drop-all-capabilities
rule: require-capabilities-drop-all
kind: Pod
resources:
- excluded-ns
result: skip
- policy: require-allow-privilege-escalation-false
rule: require-allow-privilege-escalation-false
kind: Pod
resources:
- excluded-ns
result: skip
- policy: require-resource-requests
rule: require-cpu-memory-requests
kind: Pod
resources:
- excluded-ns
result: skip

194
vendor/platform/kyverno/tests/baseline/resources.yaml vendored Normal file
View file

@ -0,0 +1,194 @@
# Compliant pod for the six Enforce baseline policies.
apiVersion: v1
kind: Pod
metadata:
name: good-pod
namespace: grafana
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
spec:
containers:
- name: app
image: busybox:1.36
resources:
requests:
cpu: 10m
memory: 16Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
---
apiVersion: v1
kind: Pod
metadata:
name: debug-ephemeral-container
namespace: grafana
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
spec:
containers:
- name: app
image: busybox:1.36
resources:
requests:
cpu: 10m
memory: 16Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
ephemeralContainers:
- name: debug
image: busybox:1.36
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
---
# Missing standard app labels.
apiVersion: v1
kind: Pod
metadata:
name: bad-labels
namespace: grafana
spec:
containers:
- name: app
image: busybox:1.36
resources:
requests:
cpu: 10m
memory: 16Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
---
# Uses the :latest tag.
apiVersion: v1
kind: Pod
metadata:
name: bad-latest
namespace: grafana
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
spec:
containers:
- name: app
image: busybox:latest
resources:
requests:
cpu: 10m
memory: 16Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
---
# privileged: true
apiVersion: v1
kind: Pod
metadata:
name: bad-privileged
namespace: grafana
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
spec:
containers:
- name: app
image: busybox:1.36
resources:
requests:
cpu: 10m
memory: 16Mi
securityContext:
privileged: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
---
# capabilities.drop does not include ALL.
apiVersion: v1
kind: Pod
metadata:
name: bad-caps
namespace: grafana
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
spec:
containers:
- name: app
image: busybox:1.36
resources:
requests:
cpu: 10m
memory: 16Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- NET_RAW
---
# allowPrivilegeEscalation unset.
apiVersion: v1
kind: Pod
metadata:
name: bad-ape
namespace: grafana
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
spec:
containers:
- name: app
image: busybox:1.36
resources:
requests:
cpu: 10m
memory: 16Mi
securityContext:
capabilities:
drop:
- ALL
---
# Missing CPU/memory requests.
apiVersion: v1
kind: Pod
metadata:
name: bad-requests
namespace: grafana
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
spec:
containers:
- name: app
image: busybox:1.36
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
---
# Control-plane namespace: policies exclude kube-system (expect skip).
apiVersion: v1
kind: Pod
metadata:
name: excluded-ns
namespace: kube-system
spec:
containers:
- name: app
image: busybox:latest

32
vendor/platform/kyverno/tests/cilium-cidrs/kyverno-test.yaml vendored Normal file
View file

@ -0,0 +1,32 @@
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
name: canonical-cilium-cidrs
policies:
- ../../policies/canonical-cilium-cidrs.yaml
resources:
- resources.yaml
results:
- policy: canonical-cilium-cidrs
rule: require-canonical-cidrs
kind: CiliumNetworkPolicy
resources:
- canonical-routed-ranges
- specific-private-peers
- dynamic-peer-groups
result: pass
- policy: canonical-cilium-cidrs
rule: require-canonical-cidrs
kind: CiliumClusterwideNetworkPolicy
resources:
- canonical-specs
result: pass
- policy: canonical-cilium-cidrs
rule: require-canonical-cidrs
kind: CiliumNetworkPolicy
resources:
- noncanonical-range
- redundant-range
- generic-private-range
- noncanonical-cidrset-exception
result: fail

109
vendor/platform/kyverno/tests/cilium-cidrs/resources.yaml vendored Normal file
View file

@ -0,0 +1,109 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: canonical-routed-ranges
namespace: default
spec:
endpointSelector: {}
ingress:
- fromCIDR:
- 10.115.187.218/24
- 10.63.81.107/24
- 10.162.8.60/24
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: specific-private-peers
namespace: default
spec:
endpointSelector: {}
ingress:
- fromCIDR:
- 10.77.102.91/32
- 10.212.111.120/32
egress:
- toCIDRSet:
- cidr: 10.90.141.119/24
except:
- 10.66.127.81/32
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: canonical-specs
spec:
specs:
- nodeSelector: {}
egress:
- toCIDR:
- 1.1.1.1/32
- nodeSelector: {}
ingress:
- fromCIDRSet:
- cidr: 10.63.81.107/24
except:
- 10.111.126.149/25
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: noncanonical-range
namespace: default
spec:
endpointSelector: {}
ingress:
- fromCIDR:
- 10.77.102.91/24
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: redundant-range
namespace: default
spec:
endpointSelector: {}
egress:
- toCIDR:
- 10.63.81.107/24
- 10.77.102.91/32
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: generic-private-range
namespace: default
spec:
endpointSelector: {}
ingress:
- fromCIDR:
- 10.87.139.185/16
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: noncanonical-cidrset-exception
namespace: default
spec:
endpointSelector: {}
egress:
- toCIDRSet:
- cidr: 10.90.141.119/24
except:
- 10.66.127.81/28
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: dynamic-peer-groups
namespace: default
spec:
endpointSelector: {}
ingress:
- fromCIDRSet:
- cidrGroupRef: short
egress:
- toCIDRSet:
- cidrGroupRef: short
- cidrGroupSelector:
matchLabels: {owner: short}

93
vendor/platform/kyverno/tests/dragonfly/kyverno-test.yaml vendored Normal file
View file

@ -0,0 +1,93 @@
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
name: dragonfly-identity
policies:
- ../../policies/require-app-labels.yaml
resources:
- resources.yaml
results:
- policy: require-app-labels
rule: dragonfly-identity
kind: Pod
resources:
- native-cache
result: pass
- policy: require-app-labels
rule: require-app-name-and-instance
kind: Pod
resources:
- native-cache
result: skip
- policy: require-app-labels
rule: dragonfly-identity
kind: Pod
resources:
- legacy-cache
result: pass
- policy: require-app-labels
rule: require-app-name-and-instance
kind: Pod
resources:
- legacy-cache
result: skip
- policy: require-app-labels
rule: dragonfly-identity
kind: Pod
resources:
- missing-cache-id
result: fail
- policy: require-app-labels
rule: require-app-name-and-instance
kind: Pod
resources:
- missing-cache-id
result: skip
- policy: require-app-labels
rule: dragonfly-identity
kind: Pod
resources:
- missing-op-id
result: fail
- policy: require-app-labels
rule: require-app-name-and-instance
kind: Pod
resources:
- missing-op-id
result: skip
- policy: require-app-labels
rule: dragonfly-identity
kind: Pod
resources:
- other-namespace
result: skip
- policy: require-app-labels
rule: require-app-name-and-instance
kind: Pod
resources:
- other-namespace
result: fail
- policy: require-app-labels
rule: autogen-dragonfly-identity
kind: StatefulSet
resources:
- native-set
result: pass
- policy: require-app-labels
rule: autogen-require-app-name-and-instance
kind: StatefulSet
resources:
- native-set
result: skip
- policy: require-app-labels
rule: autogen-dragonfly-identity
kind: StatefulSet
resources:
- missing-set-id
result: fail
- policy: require-app-labels
rule: autogen-require-app-name-and-instance
kind: StatefulSet
resources:
- missing-set-id
result: skip

102
vendor/platform/kyverno/tests/dragonfly/resources.yaml vendored Normal file
View file

@ -0,0 +1,102 @@
apiVersion: v1
kind: Pod
metadata:
name: native-cache
namespace: dragonfly
labels:
app.kubernetes.io/name: dragonfly
app: quay
spec:
containers:
- name: app
image: busybox:1.36
---
apiVersion: v1
kind: Pod
metadata:
name: legacy-cache
namespace: dragonfly
labels:
app.kubernetes.io/name: dragonfly
app.kubernetes.io/instance: quay
spec:
containers:
- name: app
image: busybox:1.36
---
apiVersion: v1
kind: Pod
metadata:
name: missing-cache-id
namespace: dragonfly
labels:
app.kubernetes.io/name: dragonfly
spec:
containers:
- name: app
image: busybox:1.36
---
apiVersion: v1
kind: Pod
metadata:
name: missing-op-id
namespace: dragonfly
labels:
app.kubernetes.io/name: dragonfly-operator
app: operator
spec:
containers:
- name: app
image: busybox:1.36
---
apiVersion: v1
kind: Pod
metadata:
name: other-namespace
namespace: quay
labels:
app.kubernetes.io/name: dragonfly
app: quay
spec:
containers:
- name: app
image: busybox:1.36
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: native-set
namespace: dragonfly
spec:
serviceName: native-set
selector:
matchLabels:
app.kubernetes.io/name: dragonfly
template:
metadata:
labels:
app.kubernetes.io/name: dragonfly
app: quay
spec:
containers:
- name: app
image: busybox:1.36
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: missing-set-id
namespace: dragonfly
spec:
serviceName: missing-set-id
selector:
matchLabels:
app.kubernetes.io/name: dragonfly
template:
metadata:
labels:
app.kubernetes.io/name: dragonfly
spec:
containers:
- name: app
image: busybox:1.36

28
vendor/platform/kyverno/tests/gateway-client/kyverno-test.yaml vendored Normal file
View file

@ -0,0 +1,28 @@
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
name: restrict-gateway-client-label
policies:
- ../../policies/restrict-gateway-client-label.yaml
resources:
- resources.yaml
results:
- policy: restrict-gateway-client-label
rule: gateway-client-label-namespace-allowlist
kind: Pod
resources:
- allowed-client
- allowed-forge-git-client
result: pass
- policy: restrict-gateway-client-label
rule: gateway-client-label-namespace-allowlist
kind: Pod
resources:
- denied-client
result: fail
- policy: restrict-gateway-client-label
rule: gateway-client-label-namespace-allowlist
kind: Pod
resources:
- no-client-label
result: skip

54
vendor/platform/kyverno/tests/gateway-client/resources.yaml vendored Normal file
View file

@ -0,0 +1,54 @@
apiVersion: v1
kind: Pod
metadata:
name: allowed-client
namespace: grafana
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
gateway.quorate.internal/allow-gateway-client: "true"
spec:
containers:
- name: app
image: busybox:1.36
---
apiVersion: v1
kind: Pod
metadata:
name: allowed-forge-git-client
namespace: forgejo-public
labels:
app.kubernetes.io/name: forgejo
app.kubernetes.io/instance: forge-git
gateway.quorate.internal/allow-gateway-client: "true"
spec:
containers:
- name: app
image: busybox:1.36
---
apiVersion: v1
kind: Pod
metadata:
name: denied-client
namespace: default
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
gateway.quorate.internal/allow-gateway-client: "true"
spec:
containers:
- name: app
image: busybox:1.36
---
apiVersion: v1
kind: Pod
metadata:
name: no-client-label
namespace: default
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
spec:
containers:
- name: app
image: busybox:1.36

25
vendor/platform/kyverno/tests/gateway-denied/kyverno-test.yaml vendored Normal file
View file

@ -0,0 +1,25 @@
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
name: gateway-denied
policies:
- ../../policies/protect-shared-gateways.yaml
- ../../policies/require-gateway-route-selectors.yaml
resources:
- resources.yaml
variables: values.yaml
userinfo: user.yaml
results:
- policy: protect-shared-gateways
rule: shared-gateway-spec-gitops-only
kind: Gateway
resources: &id001
- gateway-short
- gateway-relay
- gateway-internal
result: fail
- policy: require-gateway-route-selectors
rule: deny-from-all-on-shared-gateways
kind: Gateway
resources: *id001
result: fail

44
vendor/platform/kyverno/tests/gateway-denied/resources.yaml vendored Normal file
View file

@ -0,0 +1,44 @@
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: gateway-short
namespace: kube-system
spec:
gatewayClassName: cilium
listeners:
- name: http
port: 80
protocol: HTTP
allowedRoutes:
namespaces:
from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: gateway-relay
namespace: kube-system
spec:
gatewayClassName: cilium
listeners:
- name: http
port: 80
protocol: HTTP
allowedRoutes:
namespaces:
from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: gateway-internal
namespace: kube-system
spec:
gatewayClassName: cilium
listeners:
- name: http
port: 80
protocol: HTTP
allowedRoutes:
namespaces:
from: All

6
vendor/platform/kyverno/tests/gateway-denied/user.yaml vendored Normal file
View file

@ -0,0 +1,6 @@
apiVersion: cli.kyverno.io/v1alpha1
kind: UserInfo
metadata:
name: gateway-denied
userInfo:
username: system:serviceaccount:kube-system:cilium-operator

9
vendor/platform/kyverno/tests/gateway-denied/values.yaml vendored Normal file
View file

@ -0,0 +1,9 @@
apiVersion: cli.kyverno.io/v1alpha1
kind: Values
metadata:
name: gateway-denied
globalValues:
request.operation: UPDATE
request.oldObject.spec:
gatewayClassName: cilium
listeners: []

25
vendor/platform/kyverno/tests/gateway-flux/kyverno-test.yaml vendored Normal file
View file

@ -0,0 +1,25 @@
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
name: gateway-flux
policies:
- ../../policies/protect-shared-gateways.yaml
- ../../policies/require-gateway-route-selectors.yaml
resources:
- resources.yaml
variables: values.yaml
userinfo: user.yaml
results:
- policy: protect-shared-gateways
rule: shared-gateway-spec-gitops-only
kind: Gateway
resources: &id001
- gateway-short
- gateway-relay
- gateway-internal
result: pass
- policy: require-gateway-route-selectors
rule: deny-from-all-on-shared-gateways
kind: Gateway
resources: *id001
result: pass

53
vendor/platform/kyverno/tests/gateway-flux/resources.yaml vendored Normal file
View file

@ -0,0 +1,53 @@
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: gateway-short
namespace: kube-system
spec:
gatewayClassName: cilium
listeners:
- name: http
port: 80
protocol: HTTP
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
gateway.quorate.internal/allow-short: 'true'
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: gateway-relay
namespace: kube-system
spec:
gatewayClassName: cilium
listeners:
- name: http
port: 80
protocol: HTTP
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
gateway.quorate.internal/allow-public: 'true'
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: gateway-internal
namespace: kube-system
spec:
gatewayClassName: cilium
listeners:
- name: http
port: 80
protocol: HTTP
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
gateway.quorate.internal/allow-internal: 'true'

6
vendor/platform/kyverno/tests/gateway-flux/user.yaml vendored Normal file
View file

@ -0,0 +1,6 @@
apiVersion: cli.kyverno.io/v1alpha1
kind: UserInfo
metadata:
name: gateway-flux
userInfo:
username: system:serviceaccount:flux-system:kustomize-controller

6
vendor/platform/kyverno/tests/gateway-flux/values.yaml vendored Normal file
View file

@ -0,0 +1,6 @@
apiVersion: cli.kyverno.io/v1alpha1
kind: Values
metadata:
name: gateway-flux
globalValues:
request.operation: CREATE

25
vendor/platform/kyverno/tests/gateway-status/kyverno-test.yaml vendored Normal file
View file

@ -0,0 +1,25 @@
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
name: gateway-status
policies:
- ../../policies/protect-shared-gateways.yaml
- ../../policies/require-gateway-route-selectors.yaml
resources:
- ../gateway-flux/resources.yaml
variables: values.yaml
userinfo: user.yaml
results:
- policy: protect-shared-gateways
rule: shared-gateway-spec-gitops-only
kind: Gateway
resources: &id001
- gateway-short
- gateway-relay
- gateway-internal
result: skip
- policy: require-gateway-route-selectors
rule: deny-from-all-on-shared-gateways
kind: Gateway
resources: *id001
result: pass

6
vendor/platform/kyverno/tests/gateway-status/user.yaml vendored Normal file
View file

@ -0,0 +1,6 @@
apiVersion: cli.kyverno.io/v1alpha1
kind: UserInfo
metadata:
name: gateway-status
userInfo:
username: system:serviceaccount:kube-system:cilium-operator

51
vendor/platform/kyverno/tests/gateway-status/values.yaml vendored Normal file
View file

@ -0,0 +1,51 @@
apiVersion: cli.kyverno.io/v1alpha1
kind: Values
metadata:
name: gateway-status
globalValues:
request.operation: UPDATE
policies:
- name: protect-shared-gateways
resources:
- name: gateway-short
values:
request.oldObject.spec:
gatewayClassName: cilium
listeners:
- name: http
port: 80
protocol: HTTP
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
gateway.quorate.internal/allow-short: 'true'
- name: gateway-relay
values:
request.oldObject.spec:
gatewayClassName: cilium
listeners:
- name: http
port: 80
protocol: HTTP
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
gateway.quorate.internal/allow-public: 'true'
- name: gateway-internal
values:
request.oldObject.spec:
gatewayClassName: cilium
listeners:
- name: http
port: 80
protocol: HTTP
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
gateway.quorate.internal/allow-internal: 'true'

41
vendor/platform/kyverno/tests/image-registries/kyverno-test.yaml vendored Normal file
View file

@ -0,0 +1,41 @@
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
name: image-registries
policies:
- ../../policies/restrict-image-registries.yaml
resources:
- resources.yaml
results:
- policy: restrict-image-registries
rule: allow-internal-registries-only
kind: Pod
resources:
- registry
- quay
- zot
- internal-init
- internal-debug
result: pass
- policy: restrict-image-registries
rule: allow-internal-registries-only
kind: Pod
resources:
- external
- external-init
- external-debug
- lookalike
- suffix
result: fail
- policy: restrict-image-registries
rule: autogen-allow-internal-registries-only
kind: Deployment
resources:
- internal-deploy
result: pass
- policy: restrict-image-registries
rule: autogen-allow-internal-registries-only
kind: Deployment
resources:
- external-deploy
result: fail

Some files were not shown because too many files have changed in this diff Show more