ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/tests/baseline/kyverno-test.yaml

@@ -0,0 +1,130 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: baseline-enforce
+policies:
+  - ../../policies/require-app-labels.yaml
+  - ../../policies/deny-latest-tag.yaml
+  - ../../policies/deny-privileged.yaml
+  - ../../policies/require-drop-all-capabilities.yaml
+  - ../../policies/require-allow-privilege-escalation-false.yaml
+  - ../../policies/require-resource-requests.yaml
+resources:
+  - resources.yaml
+results:
+  - policy: require-app-labels
+    rule: require-app-name-and-instance
+    kind: Pod
+    resources:
+      - good-pod
+    result: pass
+  - policy: deny-latest-tag
+    rule: deny-latest-images
+    kind: Pod
+    resources:
+      - good-pod
+    result: pass
+  - policy: deny-privileged
+    rule: deny-privileged-containers
+    kind: Pod
+    resources:
+      - good-pod
+    result: pass
+  - policy: require-drop-all-capabilities
+    rule: require-capabilities-drop-all
+    kind: Pod
+    resources:
+      - good-pod
+    result: pass
+  - policy: require-allow-privilege-escalation-false
+    rule: require-allow-privilege-escalation-false
+    kind: Pod
+    resources:
+      - good-pod
+    result: pass
+  - policy: require-resource-requests
+    rule: require-cpu-memory-requests
+    kind: Pod
+    resources:
+      - good-pod
+    result: pass
+  - policy: require-resource-requests
+    rule: require-cpu-memory-requests
+    kind: Pod
+    resources:
+      - debug-ephemeral-container
+    result: pass
+
+  - policy: require-app-labels
+    rule: require-app-name-and-instance
+    kind: Pod
+    resources:
+      - bad-labels
+    result: fail
+  - policy: deny-latest-tag
+    rule: deny-latest-images
+    kind: Pod
+    resources:
+      - bad-latest
+    result: fail
+  - policy: deny-privileged
+    rule: deny-privileged-containers
+    kind: Pod
+    resources:
+      - bad-privileged
+    result: fail
+  - policy: require-drop-all-capabilities
+    rule: require-capabilities-drop-all
+    kind: Pod
+    resources:
+      - bad-caps
+    result: fail
+  - policy: require-allow-privilege-escalation-false
+    rule: require-allow-privilege-escalation-false
+    kind: Pod
+    resources:
+      - bad-ape
+    result: fail
+  - policy: require-resource-requests
+    rule: require-cpu-memory-requests
+    kind: Pod
+    resources:
+      - bad-requests
+    result: fail
+
+  - policy: require-app-labels
+    rule: require-app-name-and-instance
+    kind: Pod
+    resources:
+      - excluded-ns
+    result: skip
+  - policy: deny-latest-tag
+    rule: deny-latest-images
+    kind: Pod
+    resources:
+      - excluded-ns
+    result: skip
+  - policy: deny-privileged
+    rule: deny-privileged-containers
+    kind: Pod
+    resources:
+      - excluded-ns
+    result: skip
+  - policy: require-drop-all-capabilities
+    rule: require-capabilities-drop-all
+    kind: Pod
+    resources:
+      - excluded-ns
+    result: skip
+  - policy: require-allow-privilege-escalation-false
+    rule: require-allow-privilege-escalation-false
+    kind: Pod
+    resources:
+      - excluded-ns
+    result: skip
+  - policy: require-resource-requests
+    rule: require-cpu-memory-requests
+    kind: Pod
+    resources:
+      - excluded-ns
+    result: skip