ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/tests/baseline/resources.yaml

@@ -0,0 +1,194 @@
+# Compliant pod for the six Enforce baseline policies.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: good-pod
+  namespace: grafana
+  labels:
+    app.kubernetes.io/name: smoke
+    app.kubernetes.io/instance: smoke
+spec:
+  containers:
+    - name: app
+      image: busybox:1.36
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: debug-ephemeral-container
+  namespace: grafana
+  labels:
+    app.kubernetes.io/name: smoke
+    app.kubernetes.io/instance: smoke
+spec:
+  containers:
+    - name: app
+      image: busybox:1.36
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
+  ephemeralContainers:
+    - name: debug
+      image: busybox:1.36
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
+---
+# Missing standard app labels.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-labels
+  namespace: grafana
+spec:
+  containers:
+    - name: app
+      image: busybox:1.36
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
+---
+# Uses the :latest tag.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-latest
+  namespace: grafana
+  labels:
+    app.kubernetes.io/name: smoke
+    app.kubernetes.io/instance: smoke
+spec:
+  containers:
+    - name: app
+      image: busybox:latest
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
+---
+# privileged: true
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-privileged
+  namespace: grafana
+  labels:
+    app.kubernetes.io/name: smoke
+    app.kubernetes.io/instance: smoke
+spec:
+  containers:
+    - name: app
+      image: busybox:1.36
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+      securityContext:
+        privileged: true
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
+---
+# capabilities.drop does not include ALL.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-caps
+  namespace: grafana
+  labels:
+    app.kubernetes.io/name: smoke
+    app.kubernetes.io/instance: smoke
+spec:
+  containers:
+    - name: app
+      image: busybox:1.36
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - NET_RAW
+---
+# allowPrivilegeEscalation unset.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-ape
+  namespace: grafana
+  labels:
+    app.kubernetes.io/name: smoke
+    app.kubernetes.io/instance: smoke
+spec:
+  containers:
+    - name: app
+      image: busybox:1.36
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+      securityContext:
+        capabilities:
+          drop:
+            - ALL
+---
+# Missing CPU/memory requests.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-requests
+  namespace: grafana
+  labels:
+    app.kubernetes.io/name: smoke
+    app.kubernetes.io/instance: smoke
+spec:
+  containers:
+    - name: app
+      image: busybox:1.36
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
+---
+# Control-plane namespace: policies exclude kube-system (expect skip).
+apiVersion: v1
+kind: Pod
+metadata:
+  name: excluded-ns
+  namespace: kube-system
+spec:
+  containers:
+    - name: app
+      image: busybox:latest