ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
2 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

130
vendor/platform/kyverno/tests/baseline/kyverno-test.yaml vendored Normal file
View file

@ -0,0 +1,130 @@
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
name: baseline-enforce
policies:
- ../../policies/require-app-labels.yaml
- ../../policies/deny-latest-tag.yaml
- ../../policies/deny-privileged.yaml
- ../../policies/require-drop-all-capabilities.yaml
- ../../policies/require-allow-privilege-escalation-false.yaml
- ../../policies/require-resource-requests.yaml
resources:
- resources.yaml
results:
- policy: require-app-labels
rule: require-app-name-and-instance
kind: Pod
resources:
- good-pod
result: pass
- policy: deny-latest-tag
rule: deny-latest-images
kind: Pod
resources:
- good-pod
result: pass
- policy: deny-privileged
rule: deny-privileged-containers
kind: Pod
resources:
- good-pod
result: pass
- policy: require-drop-all-capabilities
rule: require-capabilities-drop-all
kind: Pod
resources:
- good-pod
result: pass
- policy: require-allow-privilege-escalation-false
rule: require-allow-privilege-escalation-false
kind: Pod
resources:
- good-pod
result: pass
- policy: require-resource-requests
rule: require-cpu-memory-requests
kind: Pod
resources:
- good-pod
result: pass
- policy: require-resource-requests
rule: require-cpu-memory-requests
kind: Pod
resources:
- debug-ephemeral-container
result: pass
- policy: require-app-labels
rule: require-app-name-and-instance
kind: Pod
resources:
- bad-labels
result: fail
- policy: deny-latest-tag
rule: deny-latest-images
kind: Pod
resources:
- bad-latest
result: fail
- policy: deny-privileged
rule: deny-privileged-containers
kind: Pod
resources:
- bad-privileged
result: fail
- policy: require-drop-all-capabilities
rule: require-capabilities-drop-all
kind: Pod
resources:
- bad-caps
result: fail
- policy: require-allow-privilege-escalation-false
rule: require-allow-privilege-escalation-false
kind: Pod
resources:
- bad-ape
result: fail
- policy: require-resource-requests
rule: require-cpu-memory-requests
kind: Pod
resources:
- bad-requests
result: fail
- policy: require-app-labels
rule: require-app-name-and-instance
kind: Pod
resources:
- excluded-ns
result: skip
- policy: deny-latest-tag
rule: deny-latest-images
kind: Pod
resources:
- excluded-ns
result: skip
- policy: deny-privileged
rule: deny-privileged-containers
kind: Pod
resources:
- excluded-ns
result: skip
- policy: require-drop-all-capabilities
rule: require-capabilities-drop-all
kind: Pod
resources:
- excluded-ns
result: skip
- policy: require-allow-privilege-escalation-false
rule: require-allow-privilege-escalation-false
kind: Pod
resources:
- excluded-ns
result: skip
- policy: require-resource-requests
rule: require-cpu-memory-requests
kind: Pod
resources:
- excluded-ns
result: skip

194
vendor/platform/kyverno/tests/baseline/resources.yaml vendored Normal file
View file

@ -0,0 +1,194 @@
# Compliant pod for the six Enforce baseline policies.
apiVersion: v1
kind: Pod
metadata:
name: good-pod
namespace: grafana
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
spec:
containers:
- name: app
image: busybox:1.36
resources:
requests:
cpu: 10m
memory: 16Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
---
apiVersion: v1
kind: Pod
metadata:
name: debug-ephemeral-container
namespace: grafana
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
spec:
containers:
- name: app
image: busybox:1.36
resources:
requests:
cpu: 10m
memory: 16Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
ephemeralContainers:
- name: debug
image: busybox:1.36
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
---
# Missing standard app labels.
apiVersion: v1
kind: Pod
metadata:
name: bad-labels
namespace: grafana
spec:
containers:
- name: app
image: busybox:1.36
resources:
requests:
cpu: 10m
memory: 16Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
---
# Uses the :latest tag.
apiVersion: v1
kind: Pod
metadata:
name: bad-latest
namespace: grafana
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
spec:
containers:
- name: app
image: busybox:latest
resources:
requests:
cpu: 10m
memory: 16Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
---
# privileged: true
apiVersion: v1
kind: Pod
metadata:
name: bad-privileged
namespace: grafana
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
spec:
containers:
- name: app
image: busybox:1.36
resources:
requests:
cpu: 10m
memory: 16Mi
securityContext:
privileged: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
---
# capabilities.drop does not include ALL.
apiVersion: v1
kind: Pod
metadata:
name: bad-caps
namespace: grafana
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
spec:
containers:
- name: app
image: busybox:1.36
resources:
requests:
cpu: 10m
memory: 16Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- NET_RAW
---
# allowPrivilegeEscalation unset.
apiVersion: v1
kind: Pod
metadata:
name: bad-ape
namespace: grafana
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
spec:
containers:
- name: app
image: busybox:1.36
resources:
requests:
cpu: 10m
memory: 16Mi
securityContext:
capabilities:
drop:
- ALL
---
# Missing CPU/memory requests.
apiVersion: v1
kind: Pod
metadata:
name: bad-requests
namespace: grafana
labels:
app.kubernetes.io/name: smoke
app.kubernetes.io/instance: smoke
spec:
containers:
- name: app
image: busybox:1.36
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
---
# Control-plane namespace: policies exclude kube-system (expect skip).
apiVersion: v1
kind: Pod
metadata:
name: excluded-ns
namespace: kube-system
spec:
containers:
- name: app
image: busybox:latest