ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
2 changed files with 145336 additions and 0 deletions
260
vendor/platform/kyverno/tests/tls-activation/kyverno-test.yaml
vendored
Normal file
260
vendor/platform/kyverno/tests/tls-activation/kyverno-test.yaml
vendored
Normal file
|
|
@ -0,0 +1,260 @@
|
|||
apiVersion: cli.kyverno.io/v1alpha1
|
||||
kind: Test
|
||||
metadata:
|
||||
name: tls-activation
|
||||
policies:
|
||||
- ../../policies/tls-activation.yaml
|
||||
resources:
|
||||
- resources.yaml
|
||||
results:
|
||||
- policy: tls-activation
|
||||
rule: tls-containers
|
||||
kind: Secret
|
||||
resources:
|
||||
- tls-test/native-tls
|
||||
- tls-test/rollout-tls
|
||||
- tls-test/projected-tls
|
||||
- tls-test/managed-tls
|
||||
- tls-test/orphan-tls
|
||||
result: pass
|
||||
- policy: tls-activation
|
||||
rule: tls-containers
|
||||
kind: Secret
|
||||
resources:
|
||||
- tls-test/vault-tls
|
||||
- tls-test/shared-tls
|
||||
- tls-test/projected-bad
|
||||
- tls-test/invalid-tls
|
||||
- tls-test/sidecar-tls
|
||||
- tls-test/opaque-tls
|
||||
- tls-test/init-tls
|
||||
result: fail
|
||||
- policy: tls-activation
|
||||
rule: tls-containers
|
||||
kind: Secret
|
||||
resources:
|
||||
- tls-test/password
|
||||
result: skip
|
||||
values:
|
||||
globalValues:
|
||||
request.operation: UPDATE
|
||||
policies:
|
||||
- name: tls-activation
|
||||
rules:
|
||||
- name: tls-containers
|
||||
values:
|
||||
pods:
|
||||
- metadata:
|
||||
annotations:
|
||||
certificates.quorate.internal/activation: null
|
||||
name: unclassified
|
||||
spec:
|
||||
containers:
|
||||
- name: server
|
||||
volumeMounts:
|
||||
- mountPath: /tls
|
||||
name: tls
|
||||
initContainers: null
|
||||
volumes:
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: vault-tls
|
||||
- metadata:
|
||||
annotations:
|
||||
certificates.quorate.internal/activation: '{"server":"controller"}'
|
||||
name: sidecar-missing
|
||||
spec:
|
||||
containers:
|
||||
- name: server
|
||||
volumeMounts:
|
||||
- mountPath: /tls
|
||||
name: tls
|
||||
- name: web
|
||||
volumeMounts:
|
||||
- mountPath: /tls
|
||||
name: tls
|
||||
initContainers: null
|
||||
volumes:
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: shared-tls
|
||||
- metadata:
|
||||
annotations:
|
||||
certificates.quorate.internal/activation: '{"server":"native"}'
|
||||
name: native
|
||||
spec:
|
||||
containers:
|
||||
- name: server
|
||||
volumeMounts:
|
||||
- mountPath: /tls
|
||||
name: tls
|
||||
initContainers: null
|
||||
volumes:
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: native-tls
|
||||
- metadata:
|
||||
annotations:
|
||||
certificates.quorate.internal/activation: '{"server":"rollout","web":"rollout"}'
|
||||
name: rollout
|
||||
ownerReferences:
|
||||
- kind: ReplicaSet
|
||||
name: deployment-rs
|
||||
controller: true
|
||||
spec:
|
||||
containers:
|
||||
- name: server
|
||||
volumeMounts:
|
||||
- mountPath: /tls
|
||||
name: tls
|
||||
- name: web
|
||||
volumeMounts:
|
||||
- mountPath: /tls
|
||||
name: tls
|
||||
initContainers: null
|
||||
volumes:
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: rollout-tls
|
||||
- metadata:
|
||||
annotations:
|
||||
certificates.quorate.internal/activation: '{"server":"native"}'
|
||||
name: projected
|
||||
spec:
|
||||
containers:
|
||||
- name: server
|
||||
volumeMounts:
|
||||
- mountPath: /tls
|
||||
name: tls
|
||||
initContainers: null
|
||||
volumes:
|
||||
- name: tls
|
||||
projected:
|
||||
sources:
|
||||
- secret:
|
||||
name: projected-tls
|
||||
- metadata:
|
||||
annotations:
|
||||
certificates.quorate.internal/activation: null
|
||||
name: projected-missing
|
||||
spec:
|
||||
containers:
|
||||
- name: server
|
||||
volumeMounts:
|
||||
- mountPath: /tls
|
||||
name: tls
|
||||
initContainers: null
|
||||
volumes:
|
||||
- name: tls
|
||||
projected:
|
||||
sources:
|
||||
- secret:
|
||||
name: projected-bad
|
||||
- metadata:
|
||||
annotations:
|
||||
certificates.quorate.internal/activation: '{"server":"manual"}'
|
||||
name: invalid
|
||||
spec:
|
||||
containers:
|
||||
- name: server
|
||||
volumeMounts:
|
||||
- mountPath: /tls
|
||||
name: tls
|
||||
initContainers: null
|
||||
volumes:
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: invalid-tls
|
||||
- metadata:
|
||||
annotations:
|
||||
certificates.quorate.internal/activation: null
|
||||
name: native-sidecar
|
||||
spec:
|
||||
containers:
|
||||
- name: server
|
||||
volumeMounts: null
|
||||
initContainers:
|
||||
- name: tls-sidecar
|
||||
restartPolicy: Always
|
||||
volumeMounts:
|
||||
- mountPath: /tls
|
||||
name: tls
|
||||
volumes:
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: sidecar-tls
|
||||
- metadata:
|
||||
annotations:
|
||||
certificates.quorate.internal/activation: null
|
||||
name: init-only
|
||||
spec:
|
||||
containers:
|
||||
- name: server
|
||||
volumeMounts: null
|
||||
initContainers:
|
||||
- name: tls-init
|
||||
restartPolicy: null
|
||||
volumeMounts:
|
||||
- mountPath: /tls
|
||||
name: tls
|
||||
volumes:
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: init-tls
|
||||
- metadata:
|
||||
annotations:
|
||||
certificates.quorate.internal/activation: null
|
||||
name: credentials
|
||||
spec:
|
||||
containers:
|
||||
- name: server
|
||||
volumeMounts:
|
||||
- mountPath: /tls
|
||||
name: tls
|
||||
initContainers: null
|
||||
volumes:
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: password
|
||||
- metadata:
|
||||
annotations:
|
||||
certificates.quorate.internal/activation: null
|
||||
name: opaque
|
||||
spec:
|
||||
containers:
|
||||
- name: server
|
||||
volumeMounts:
|
||||
- mountPath: /tls
|
||||
name: tls
|
||||
initContainers: null
|
||||
volumes:
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: opaque-tls
|
||||
- metadata:
|
||||
annotations:
|
||||
certificates.quorate.internal/activation: null
|
||||
name: managed
|
||||
ownerReferences:
|
||||
- kind: ReplicaSet
|
||||
name: deployment-rs
|
||||
controller: true
|
||||
spec:
|
||||
containers:
|
||||
- name: server
|
||||
volumeMounts:
|
||||
- mountPath: /tls
|
||||
name: tls
|
||||
initContainers: null
|
||||
volumes:
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: managed-tls
|
||||
deployments:
|
||||
- deployment
|
||||
replicas:
|
||||
- deployment-rs
|
||||
daemonsets:
|
||||
- daemon
|
||||
statefulsets:
|
||||
- stateful
|
||||
128
vendor/platform/kyverno/tests/tls-activation/resources.yaml
vendored
Normal file
128
vendor/platform/kyverno/tests/tls-activation/resources.yaml
vendored
Normal file
|
|
@ -0,0 +1,128 @@
|
|||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: vault-tls
|
||||
namespace: tls-test
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: c3ludGhldGljLW5ldw==
|
||||
tls.key: c3ludGhldGljLWtleQ==
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: shared-tls
|
||||
namespace: tls-test
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: c3ludGhldGljLW5ldw==
|
||||
tls.key: c3ludGhldGljLWtleQ==
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: native-tls
|
||||
namespace: tls-test
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: c3ludGhldGljLW5ldw==
|
||||
tls.key: c3ludGhldGljLWtleQ==
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: rollout-tls
|
||||
namespace: tls-test
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: c3ludGhldGljLW5ldw==
|
||||
tls.key: c3ludGhldGljLWtleQ==
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: projected-tls
|
||||
namespace: tls-test
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: c3ludGhldGljLW5ldw==
|
||||
tls.key: c3ludGhldGljLWtleQ==
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: projected-bad
|
||||
namespace: tls-test
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: c3ludGhldGljLW5ldw==
|
||||
tls.key: c3ludGhldGljLWtleQ==
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: invalid-tls
|
||||
namespace: tls-test
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: c3ludGhldGljLW5ldw==
|
||||
tls.key: c3ludGhldGljLWtleQ==
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: sidecar-tls
|
||||
namespace: tls-test
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: c3ludGhldGljLW5ldw==
|
||||
tls.key: c3ludGhldGljLWtleQ==
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: init-tls
|
||||
namespace: tls-test
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: c3ludGhldGljLW5ldw==
|
||||
tls.key: c3ludGhldGljLWtleQ==
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: password
|
||||
namespace: tls-test
|
||||
type: Opaque
|
||||
data:
|
||||
password: c3ludGhldGlj
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: opaque-tls
|
||||
namespace: tls-test
|
||||
type: Opaque
|
||||
data:
|
||||
tls.crt: c3ludGhldGljLW5ldw==
|
||||
tls.key: c3ludGhldGljLWtleQ==
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: managed-tls
|
||||
namespace: tls-test
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: c3ludGhldGljLW5ldw==
|
||||
tls.key: c3ludGhldGljLWtleQ==
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: orphan-tls
|
||||
namespace: tls-test
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: c3ludGhldGljLW5ldw==
|
||||
tls.key: c3ludGhldGljLWtleQ==
|
||||
Loading…
Reference in a new issue