ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/tests/gateway-status/kyverno-test.yaml

@@ -0,0 +1,25 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: gateway-status
+policies:
+- ../../policies/protect-shared-gateways.yaml
+- ../../policies/require-gateway-route-selectors.yaml
+resources:
+- ../gateway-flux/resources.yaml
+variables: values.yaml
+userinfo: user.yaml
+results:
+- policy: protect-shared-gateways
+  rule: shared-gateway-spec-gitops-only
+  kind: Gateway
+  resources: &id001
+  - gateway-short
+  - gateway-relay
+  - gateway-internal
+  result: skip
+- policy: require-gateway-route-selectors
+  rule: deny-from-all-on-shared-gateways
+  kind: Gateway
+  resources: *id001
+  result: pass

vendor/platform/kyverno/tests/gateway-status/user.yaml

@@ -0,0 +1,6 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: UserInfo
+metadata:
+  name: gateway-status
+userInfo:
+  username: system:serviceaccount:kube-system:cilium-operator

vendor/platform/kyverno/tests/gateway-status/values.yaml

@@ -0,0 +1,51 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Values
+metadata:
+  name: gateway-status
+globalValues:
+  request.operation: UPDATE
+policies:
+- name: protect-shared-gateways
+  resources:
+  - name: gateway-short
+    values:
+      request.oldObject.spec:
+        gatewayClassName: cilium
+        listeners:
+        - name: http
+          port: 80
+          protocol: HTTP
+          allowedRoutes:
+            namespaces:
+              from: Selector
+              selector:
+                matchLabels:
+                  gateway.quorate.internal/allow-short: 'true'
+  - name: gateway-relay
+    values:
+      request.oldObject.spec:
+        gatewayClassName: cilium
+        listeners:
+        - name: http
+          port: 80
+          protocol: HTTP
+          allowedRoutes:
+            namespaces:
+              from: Selector
+              selector:
+                matchLabels:
+                  gateway.quorate.internal/allow-public: 'true'
+  - name: gateway-internal
+    values:
+      request.oldObject.spec:
+        gatewayClassName: cilium
+        listeners:
+        - name: http
+          port: 80
+          protocol: HTTP
+          allowedRoutes:
+            namespaces:
+              from: Selector
+              selector:
+                matchLabels:
+                  gateway.quorate.internal/allow-internal: 'true'