ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/tests/route-parentrefs/kyverno-test.yaml

@@ -0,0 +1,54 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: restrict-route-parentrefs
+policies:
+  - ../../policies/restrict-route-parentrefs.yaml
+resources:
+  - resources.yaml
+variables: values.yaml
+results:
+  - policy: restrict-route-parentrefs
+    rule: parentref-matches-namespace-labels
+    kind: HTTPRoute
+    resources:
+      - allowed-relay
+      - allowed-internal
+      - unrelated-gateway
+    result: pass
+  - policy: restrict-route-parentrefs
+    rule: parentref-matches-namespace-labels
+    kind: HTTPRoute
+    resources:
+      - denied-relay
+      - denied-internal
+    result: fail
+  - policy: restrict-route-parentrefs
+    rule: short-parent-label
+    kind: HTTPRoute
+    resources:
+      - short-http-allowed
+      - unrelated-gateway
+    result: pass
+  - policy: restrict-route-parentrefs
+    rule: short-parent-label
+    kind: HTTPRoute
+    resources:
+      - short-http-denied
+      - short-http-public
+      - mixed-parents
+    result: fail
+  - policy: restrict-route-parentrefs
+    rule: short-parent-label
+    kind: TCPRoute
+    resources:
+      - short-tcp-allowed
+      - unrelated-tcp
+    result: pass
+  - policy: restrict-route-parentrefs
+    rule: short-parent-label
+    kind: TCPRoute
+    resources:
+      - short-tcp-denied
+      - short-tcp-public
+    result: fail

vendor/platform/kyverno/tests/route-parentrefs/resources.yaml

@@ -0,0 +1,130 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: allowed-relay
+  namespace: public-client
+spec:
+  parentRefs:
+    - name: gateway-relay
+      namespace: kube-system
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: denied-relay
+  namespace: denied-client
+spec:
+  parentRefs:
+    - name: gateway-relay
+      namespace: kube-system
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: allowed-internal
+  namespace: internal-client
+spec:
+  parentRefs:
+    - name: gateway-internal
+      namespace: kube-system
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: denied-internal
+  namespace: denied-client
+spec:
+  parentRefs:
+    - name: gateway-internal
+      namespace: kube-system
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: unrelated-gateway
+  namespace: denied-client
+spec:
+  parentRefs:
+    - name: application-gateway
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: short-http-allowed
+  namespace: short-client
+spec:
+  parentRefs:
+    - name: gateway-short
+      namespace: kube-system
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: short-http-denied
+  namespace: denied-client
+spec:
+  parentRefs:
+    - name: gateway-short
+      namespace: kube-system
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: short-http-public
+  namespace: public-client
+spec:
+  parentRefs:
+    - name: gateway-short
+      namespace: kube-system
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: TCPRoute
+metadata:
+  name: short-tcp-allowed
+  namespace: minecraft
+spec:
+  parentRefs:
+    - name: gateway-short
+      namespace: kube-system
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: TCPRoute
+metadata:
+  name: short-tcp-denied
+  namespace: denied-client
+spec:
+  parentRefs:
+    - name: gateway-short
+      namespace: kube-system
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: TCPRoute
+metadata:
+  name: short-tcp-public
+  namespace: public-client
+spec:
+  parentRefs:
+    - name: gateway-short
+      namespace: kube-system
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: TCPRoute
+metadata:
+  name: unrelated-tcp
+  namespace: denied-client
+spec:
+  parentRefs:
+    - name: gateway-relay
+      namespace: kube-system
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: mixed-parents
+  namespace: public-client
+spec:
+  parentRefs:
+    - name: gateway-relay
+      namespace: kube-system
+    - name: gateway-short
+      namespace: kube-system

vendor/platform/kyverno/tests/route-parentrefs/values.yaml

@@ -0,0 +1,54 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Values
+metadata:
+  name: restrict-route-parentrefs-values
+policies:
+  - name: restrict-route-parentrefs
+    resources:
+      - name: allowed-relay
+        values:
+          nslabels:
+            gateway.quorate.internal/allow-public: "true"
+      - name: denied-relay
+        values:
+          nslabels: {}
+      - name: allowed-internal
+        values:
+          nslabels:
+            gateway.quorate.internal/allow-internal: "true"
+      - name: denied-internal
+        values:
+          nslabels: {}
+      - name: unrelated-gateway
+        values:
+          nslabels: {}
+      - name: short-http-allowed
+        values:
+          nslabels:
+            gateway.quorate.internal/allow-short: "true"
+      - name: short-http-denied
+        values:
+          nslabels: {}
+      - name: short-http-public
+        values:
+          nslabels:
+            gateway.quorate.internal/allow-public: "true"
+      - name: short-tcp-allowed
+        values:
+          nslabels:
+            gateway.quorate.internal/allow-short: "true"
+      - name: short-tcp-denied
+        values:
+          nslabels:
+            gateway.quorate.internal/allow-short: "false"
+      - name: short-tcp-public
+        values:
+          nslabels:
+            gateway.quorate.internal/allow-public: "true"
+      - name: unrelated-tcp
+        values:
+          nslabels: {}
+      - name: mixed-parents
+        values:
+          nslabels:
+            gateway.quorate.internal/allow-public: "true"