ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/tests/public-runtime/kyverno-test.yaml

@@ -0,0 +1,28 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: require-public-runtime-gvisor
+policies:
+  - ../../policies/require-public-runtime-gvisor.yaml
+resources:
+  - resources.yaml
+variables: values.yaml
+results:
+  - policy: require-public-runtime-gvisor
+    rule: public-pods-use-gvisor
+    kind: Pod
+    resources:
+      - public-gvisor
+    result: pass
+  - policy: require-public-runtime-gvisor
+    rule: public-pods-use-gvisor
+    kind: Pod
+    resources:
+      - public-runc
+    result: fail
+  - policy: require-public-runtime-gvisor
+    rule: public-pods-use-gvisor
+    kind: Pod
+    resources:
+      - private-runc
+    result: skip

vendor/platform/kyverno/tests/public-runtime/resources.yaml

@@ -0,0 +1,42 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: public
+  labels:
+    security.quorate.internal/public-runtime: gvisor
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: private
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: public-gvisor
+  namespace: public
+spec:
+  runtimeClassName: gvisor
+  containers:
+    - name: test
+      image: example.com/test:v1
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: public-runc
+  namespace: public
+spec:
+  containers:
+    - name: test
+      image: example.com/test:v1
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: private-runc
+  namespace: private
+spec:
+  containers:
+    - name: test
+      image: example.com/test:v1

vendor/platform/kyverno/tests/public-runtime/values.yaml

@@ -0,0 +1,10 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Values
+metadata:
+  name: require-public-runtime-gvisor-values
+namespaceSelector:
+  - name: public
+    labels:
+      security.quorate.internal/public-runtime: gvisor
+  - name: private
+    labels: {}