ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/tests/tls-rollout/kyverno-test.yaml

@@ -0,0 +1,115 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: tls-rollout
+policies:
+- ../../policies/tls-rollout.yaml
+resources:
+- resources.yaml
+targetResources:
+- targets.yaml
+values:
+  globalValues:
+    request.operation: UPDATE
+    request.oldObject.data:
+      tls.crt: c3ludGhldGljLW9sZA==
+results:
+- policy: tls-rollout
+  rule: deployments
+  kind: Deployment
+  resources:
+  - tls-test/direct
+  - tls-test/projected
+  - tls-test/environment
+  - tls-test/mixed
+  patchedResources: patched.yaml
+  result: pass
+- policy: tls-rollout
+  rule: daemonsets
+  kind: DaemonSet
+  resources:
+  - tls-test/daemon
+  patchedResources: patched.yaml
+  result: pass
+- policy: tls-rollout
+  rule: statefulsets
+  kind: StatefulSet
+  resources:
+  - tls-test/stateful
+  patchedResources: patched.yaml
+  result: pass
+---
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: tls-unchanged
+policies:
+- ../../policies/tls-rollout.yaml
+resources:
+- resources.yaml
+targetResources:
+- targets.yaml
+values:
+  globalValues:
+    request.operation: UPDATE
+    request.oldObject.data:
+      tls.crt: c3ludGhldGljLW5ldw==
+results:
+- policy: tls-rollout
+  rule: deployments
+  kind: Secret
+  resources:
+  - tls-test/cert
+  result: skip
+- policy: tls-rollout
+  rule: daemonsets
+  kind: Secret
+  resources:
+  - tls-test/cert
+  result: skip
+- policy: tls-rollout
+  rule: statefulsets
+  kind: Secret
+  resources:
+  - tls-test/cert
+  result: skip
+---
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: tls-created
+policies:
+- ../../policies/tls-rollout.yaml
+resources:
+- resources.yaml
+targetResources:
+- targets.yaml
+values:
+  globalValues:
+    request.operation: CREATE
+    request.oldObject.data: {}
+results:
+- policy: tls-rollout
+  rule: deployments
+  kind: Deployment
+  resources:
+  - tls-test/direct
+  - tls-test/projected
+  - tls-test/environment
+  - tls-test/mixed
+  patchedResources: patched.yaml
+  result: pass
+- policy: tls-rollout
+  rule: daemonsets
+  kind: DaemonSet
+  resources:
+  - tls-test/daemon
+  patchedResources: patched.yaml
+  result: pass
+- policy: tls-rollout
+  rule: statefulsets
+  kind: StatefulSet
+  resources:
+  - tls-test/stateful
+  patchedResources: patched.yaml
+  result: pass

vendor/platform/kyverno/tests/tls-rollout/patched.yaml

@@ -0,0 +1,174 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: direct
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: direct
+  template:
+    metadata:
+      labels:
+        app: direct
+      annotations:
+        keep: 'yes'
+        certificates.quorate.internal/06298432e8066b29e2223bcc23aa9504: 1bde867175a112045010fea7ac3ee3337a9b08db7591609abbaf11efb2dfbd35
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        secret:
+          secretName: cert
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: projected
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: projected
+  template:
+    metadata:
+      labels:
+        app: projected
+      annotations:
+        keep: 'yes'
+        certificates.quorate.internal/06298432e8066b29e2223bcc23aa9504: 1bde867175a112045010fea7ac3ee3337a9b08db7591609abbaf11efb2dfbd35
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        projected:
+          sources:
+          - secret:
+              name: cert
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: environment
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: environment
+  template:
+    metadata:
+      labels:
+        app: environment
+      annotations:
+        keep: 'yes'
+        certificates.quorate.internal/06298432e8066b29e2223bcc23aa9504: 1bde867175a112045010fea7ac3ee3337a9b08db7591609abbaf11efb2dfbd35
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        env:
+        - name: CERT
+          valueFrom:
+            secretKeyRef:
+              name: cert
+              key: tls.crt
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mixed
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: mixed
+  template:
+    metadata:
+      labels:
+        app: mixed
+      annotations:
+        keep: 'yes'
+        certificates.quorate.internal/activation: '{"server":"native"}'
+        certificates.quorate.internal/06298432e8066b29e2223bcc23aa9504: 1bde867175a112045010fea7ac3ee3337a9b08db7591609abbaf11efb2dfbd35
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      - name: sidecar
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        secret:
+          secretName: cert
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: daemon
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: daemon
+  template:
+    metadata:
+      labels:
+        app: daemon
+      annotations:
+        keep: 'yes'
+        certificates.quorate.internal/06298432e8066b29e2223bcc23aa9504: 1bde867175a112045010fea7ac3ee3337a9b08db7591609abbaf11efb2dfbd35
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        secret:
+          secretName: cert
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: stateful
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: stateful
+  template:
+    metadata:
+      labels:
+        app: stateful
+      annotations:
+        keep: 'yes'
+        certificates.quorate.internal/06298432e8066b29e2223bcc23aa9504: 1bde867175a112045010fea7ac3ee3337a9b08db7591609abbaf11efb2dfbd35
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        secret:
+          secretName: cert

vendor/platform/kyverno/tests/tls-rollout/resources.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cert
+  namespace: tls-test
+data:
+  tls.crt: c3ludGhldGljLW5ldw==

vendor/platform/kyverno/tests/tls-rollout/targets.yaml

@@ -0,0 +1,338 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: direct
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: direct
+  template:
+    metadata:
+      labels:
+        app: direct
+      annotations:
+        keep: 'yes'
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        secret:
+          secretName: cert
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: projected
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: projected
+  template:
+    metadata:
+      labels:
+        app: projected
+      annotations:
+        keep: 'yes'
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        projected:
+          sources:
+          - secret:
+              name: cert
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: environment
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: environment
+  template:
+    metadata:
+      labels:
+        app: environment
+      annotations:
+        keep: 'yes'
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        env:
+        - name: CERT
+          valueFrom:
+            secretKeyRef:
+              name: cert
+              key: tls.crt
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: native
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: native
+  template:
+    metadata:
+      labels:
+        app: native
+      annotations:
+        keep: 'yes'
+        certificates.quorate.internal/activation: '{"server":"native"}'
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        secret:
+          secretName: cert
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mixed
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: mixed
+  template:
+    metadata:
+      labels:
+        app: mixed
+      annotations:
+        keep: 'yes'
+        certificates.quorate.internal/activation: '{"server":"native"}'
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      - name: sidecar
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        secret:
+          secretName: cert
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: unrelated
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: unrelated
+  template:
+    metadata:
+      labels:
+        app: unrelated
+      annotations:
+        keep: 'yes'
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        secret:
+          secretName: other
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: paused
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: paused
+  template:
+    metadata:
+      labels:
+        app: paused
+      annotations:
+        keep: 'yes'
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        secret:
+          secretName: cert
+  paused: true
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: daemon
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: daemon
+  template:
+    metadata:
+      labels:
+        app: daemon
+      annotations:
+        keep: 'yes'
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        secret:
+          secretName: cert
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: stateful
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: stateful
+  template:
+    metadata:
+      labels:
+        app: stateful
+      annotations:
+        keep: 'yes'
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        secret:
+          secretName: cert
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: on-delete
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: on-delete
+  template:
+    metadata:
+      labels:
+        app: on-delete
+      annotations:
+        keep: 'yes'
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        secret:
+          secretName: cert
+  updateStrategy:
+    type: OnDelete
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: partition
+  namespace: tls-test
+spec:
+  selector:
+    matchLabels:
+      app: partition
+  template:
+    metadata:
+      labels:
+        app: partition
+      annotations:
+        keep: 'yes'
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        secret:
+          secretName: cert
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      partition: 1
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: wrong-ns
+  namespace: elsewhere
+spec:
+  selector:
+    matchLabels:
+      app: wrong-ns
+  template:
+    metadata:
+      labels:
+        app: wrong-ns
+      annotations:
+        keep: 'yes'
+    spec:
+      containers:
+      - name: server
+        image: example.invalid/test:fake
+        volumeMounts:
+        - name: tls
+          mountPath: /tls
+      volumes:
+      - name: tls
+        secret:
+          secretName: cert