ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/tests/image-registries/kyverno-test.yaml

@@ -0,0 +1,41 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: image-registries
+policies:
+  - ../../policies/restrict-image-registries.yaml
+resources:
+  - resources.yaml
+results:
+  - policy: restrict-image-registries
+    rule: allow-internal-registries-only
+    kind: Pod
+    resources:
+      - registry
+      - quay
+      - zot
+      - internal-init
+      - internal-debug
+    result: pass
+  - policy: restrict-image-registries
+    rule: allow-internal-registries-only
+    kind: Pod
+    resources:
+      - external
+      - external-init
+      - external-debug
+      - lookalike
+      - suffix
+    result: fail
+  - policy: restrict-image-registries
+    rule: autogen-allow-internal-registries-only
+    kind: Deployment
+    resources:
+      - internal-deploy
+    result: pass
+  - policy: restrict-image-registries
+    rule: autogen-allow-internal-registries-only
+    kind: Deployment
+    resources:
+      - external-deploy
+    result: fail

vendor/platform/kyverno/tests/image-registries/resources.yaml

@@ -0,0 +1,147 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: registry
+  namespace: mirrored-image
+spec:
+  containers:
+    - name: probe
+      image: registry.quorate.internal/quorate/app:v1
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: quay
+  namespace: mirrored-image
+spec:
+  containers:
+    - name: probe
+      image: quay.quorate.internal/mirror/app:v1
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: zot
+  namespace: mirrored-image
+spec:
+  containers:
+    - name: probe
+      image: zot.quorate.internal/quay/quay:v1
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: internal-init
+  namespace: mirrored-image
+spec:
+  containers:
+    - name: app
+      image: registry.quorate.internal/quorate/app:v1
+  initContainers:
+    - name: probe
+      image: registry.quorate.internal/quorate/app:v1
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: internal-debug
+  namespace: mirrored-image
+spec:
+  containers:
+    - name: app
+      image: registry.quorate.internal/quorate/app:v1
+  ephemeralContainers:
+    - name: probe
+      image: registry.quorate.internal/quorate/app:v1
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: external
+  namespace: mirrored-image
+spec:
+  containers:
+    - name: probe
+      image: quay.io/argoproj/argoexec:v4.1.2
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: external-init
+  namespace: mirrored-image
+spec:
+  containers:
+    - name: app
+      image: registry.quorate.internal/quorate/app:v1
+  initContainers:
+    - name: probe
+      image: docker.io/library/busybox:v1
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: external-debug
+  namespace: mirrored-image
+spec:
+  containers:
+    - name: app
+      image: registry.quorate.internal/quorate/app:v1
+  ephemeralContainers:
+    - name: probe
+      image: docker.io/library/busybox:v1
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: lookalike
+  namespace: mirrored-image
+spec:
+  containers:
+    - name: probe
+      image: registryXquorateXinternal/app:v1
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: suffix
+  namespace: mirrored-image
+spec:
+  containers:
+    - name: probe
+      image: registry.quorate.internal.example/app:v1
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: internal-deploy
+  namespace: mirrored-image
+spec:
+  selector:
+    matchLabels:
+      app: internal-deploy
+  template:
+    metadata:
+      labels:
+        app: internal-deploy
+    spec:
+      containers:
+        - name: app
+          image: registry.quorate.internal/quorate/app:v1
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: external-deploy
+  namespace: mirrored-image
+spec:
+  selector:
+    matchLabels:
+      app: external-deploy
+  template:
+    metadata:
+      labels:
+        app: external-deploy
+    spec:
+      containers:
+        - name: app
+          image: quay.io/argoproj/argoexec:v4.1.2