ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/tests/gateway-denied/kyverno-test.yaml

@@ -0,0 +1,25 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: gateway-denied
+policies:
+- ../../policies/protect-shared-gateways.yaml
+- ../../policies/require-gateway-route-selectors.yaml
+resources:
+- resources.yaml
+variables: values.yaml
+userinfo: user.yaml
+results:
+- policy: protect-shared-gateways
+  rule: shared-gateway-spec-gitops-only
+  kind: Gateway
+  resources: &id001
+  - gateway-short
+  - gateway-relay
+  - gateway-internal
+  result: fail
+- policy: require-gateway-route-selectors
+  rule: deny-from-all-on-shared-gateways
+  kind: Gateway
+  resources: *id001
+  result: fail

vendor/platform/kyverno/tests/gateway-denied/resources.yaml

@@ -0,0 +1,44 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway-short
+  namespace: kube-system
+spec:
+  gatewayClassName: cilium
+  listeners:
+  - name: http
+    port: 80
+    protocol: HTTP
+    allowedRoutes:
+      namespaces:
+        from: All
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway-relay
+  namespace: kube-system
+spec:
+  gatewayClassName: cilium
+  listeners:
+  - name: http
+    port: 80
+    protocol: HTTP
+    allowedRoutes:
+      namespaces:
+        from: All
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway-internal
+  namespace: kube-system
+spec:
+  gatewayClassName: cilium
+  listeners:
+  - name: http
+    port: 80
+    protocol: HTTP
+    allowedRoutes:
+      namespaces:
+        from: All

vendor/platform/kyverno/tests/gateway-denied/user.yaml

@@ -0,0 +1,6 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: UserInfo
+metadata:
+  name: gateway-denied
+userInfo:
+  username: system:serviceaccount:kube-system:cilium-operator

vendor/platform/kyverno/tests/gateway-denied/values.yaml

@@ -0,0 +1,9 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Values
+metadata:
+  name: gateway-denied
+globalValues:
+  request.operation: UPDATE
+  request.oldObject.spec:
+    gatewayClassName: cilium
+    listeners: []