ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/tests/gateway-flux/kyverno-test.yaml

@@ -0,0 +1,25 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: gateway-flux
+policies:
+- ../../policies/protect-shared-gateways.yaml
+- ../../policies/require-gateway-route-selectors.yaml
+resources:
+- resources.yaml
+variables: values.yaml
+userinfo: user.yaml
+results:
+- policy: protect-shared-gateways
+  rule: shared-gateway-spec-gitops-only
+  kind: Gateway
+  resources: &id001
+  - gateway-short
+  - gateway-relay
+  - gateway-internal
+  result: pass
+- policy: require-gateway-route-selectors
+  rule: deny-from-all-on-shared-gateways
+  kind: Gateway
+  resources: *id001
+  result: pass

vendor/platform/kyverno/tests/gateway-flux/resources.yaml

@@ -0,0 +1,53 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway-short
+  namespace: kube-system
+spec:
+  gatewayClassName: cilium
+  listeners:
+  - name: http
+    port: 80
+    protocol: HTTP
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            gateway.quorate.internal/allow-short: 'true'
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway-relay
+  namespace: kube-system
+spec:
+  gatewayClassName: cilium
+  listeners:
+  - name: http
+    port: 80
+    protocol: HTTP
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            gateway.quorate.internal/allow-public: 'true'
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway-internal
+  namespace: kube-system
+spec:
+  gatewayClassName: cilium
+  listeners:
+  - name: http
+    port: 80
+    protocol: HTTP
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            gateway.quorate.internal/allow-internal: 'true'

vendor/platform/kyverno/tests/gateway-flux/user.yaml

@@ -0,0 +1,6 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: UserInfo
+metadata:
+  name: gateway-flux
+userInfo:
+  username: system:serviceaccount:flux-system:kustomize-controller

vendor/platform/kyverno/tests/gateway-flux/values.yaml

@@ -0,0 +1,6 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Values
+metadata:
+  name: gateway-flux
+globalValues:
+  request.operation: CREATE