apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
  name: tls-activation
policies:
- ../../policies/tls-activation.yaml
resources:
- resources.yaml
results:
- policy: tls-activation
  rule: tls-containers
  kind: Secret
  resources:
  - tls-test/native-tls
  - tls-test/rollout-tls
  - tls-test/projected-tls
  - tls-test/managed-tls
  - tls-test/orphan-tls
  result: pass
- policy: tls-activation
  rule: tls-containers
  kind: Secret
  resources:
  - tls-test/vault-tls
  - tls-test/shared-tls
  - tls-test/projected-bad
  - tls-test/invalid-tls
  - tls-test/sidecar-tls
  - tls-test/opaque-tls
  - tls-test/init-tls
  result: fail
- policy: tls-activation
  rule: tls-containers
  kind: Secret
  resources:
  - tls-test/password
  result: skip
values:
  globalValues:
    request.operation: UPDATE
  policies:
  - name: tls-activation
    rules:
    - name: tls-containers
      values:
        pods:
        - metadata:
            annotations:
              certificates.quorate.internal/activation: null
            name: unclassified
          spec:
            containers:
            - name: server
              volumeMounts:
              - mountPath: /tls
                name: tls
            initContainers: null
            volumes:
            - name: tls
              secret:
                secretName: vault-tls
        - metadata:
            annotations:
              certificates.quorate.internal/activation: '{"server":"controller"}'
            name: sidecar-missing
          spec:
            containers:
            - name: server
              volumeMounts:
              - mountPath: /tls
                name: tls
            - name: web
              volumeMounts:
              - mountPath: /tls
                name: tls
            initContainers: null
            volumes:
            - name: tls
              secret:
                secretName: shared-tls
        - metadata:
            annotations:
              certificates.quorate.internal/activation: '{"server":"native"}'
            name: native
          spec:
            containers:
            - name: server
              volumeMounts:
              - mountPath: /tls
                name: tls
            initContainers: null
            volumes:
            - name: tls
              secret:
                secretName: native-tls
        - metadata:
            annotations:
              certificates.quorate.internal/activation: '{"server":"rollout","web":"rollout"}'
            name: rollout
            ownerReferences:
            - kind: ReplicaSet
              name: deployment-rs
              controller: true
          spec:
            containers:
            - name: server
              volumeMounts:
              - mountPath: /tls
                name: tls
            - name: web
              volumeMounts:
              - mountPath: /tls
                name: tls
            initContainers: null
            volumes:
            - name: tls
              secret:
                secretName: rollout-tls
        - metadata:
            annotations:
              certificates.quorate.internal/activation: '{"server":"native"}'
            name: projected
          spec:
            containers:
            - name: server
              volumeMounts:
              - mountPath: /tls
                name: tls
            initContainers: null
            volumes:
            - name: tls
              projected:
                sources:
                - secret:
                    name: projected-tls
        - metadata:
            annotations:
              certificates.quorate.internal/activation: null
            name: projected-missing
          spec:
            containers:
            - name: server
              volumeMounts:
              - mountPath: /tls
                name: tls
            initContainers: null
            volumes:
            - name: tls
              projected:
                sources:
                - secret:
                    name: projected-bad
        - metadata:
            annotations:
              certificates.quorate.internal/activation: '{"server":"manual"}'
            name: invalid
          spec:
            containers:
            - name: server
              volumeMounts:
              - mountPath: /tls
                name: tls
            initContainers: null
            volumes:
            - name: tls
              secret:
                secretName: invalid-tls
        - metadata:
            annotations:
              certificates.quorate.internal/activation: null
            name: native-sidecar
          spec:
            containers:
            - name: server
              volumeMounts: null
            initContainers:
            - name: tls-sidecar
              restartPolicy: Always
              volumeMounts:
              - mountPath: /tls
                name: tls
            volumes:
            - name: tls
              secret:
                secretName: sidecar-tls
        - metadata:
            annotations:
              certificates.quorate.internal/activation: null
            name: init-only
          spec:
            containers:
            - name: server
              volumeMounts: null
            initContainers:
            - name: tls-init
              restartPolicy: null
              volumeMounts:
              - mountPath: /tls
                name: tls
            volumes:
            - name: tls
              secret:
                secretName: init-tls
        - metadata:
            annotations:
              certificates.quorate.internal/activation: null
            name: credentials
          spec:
            containers:
            - name: server
              volumeMounts:
              - mountPath: /tls
                name: tls
            initContainers: null
            volumes:
            - name: tls
              secret:
                secretName: password
        - metadata:
            annotations:
              certificates.quorate.internal/activation: null
            name: opaque
          spec:
            containers:
            - name: server
              volumeMounts:
              - mountPath: /tls
                name: tls
            initContainers: null
            volumes:
            - name: tls
              secret:
                secretName: opaque-tls
        - metadata:
            annotations:
              certificates.quorate.internal/activation: null
            name: managed
            ownerReferences:
            - kind: ReplicaSet
              name: deployment-rs
              controller: true
          spec:
            containers:
            - name: server
              volumeMounts:
              - mountPath: /tls
                name: tls
            initContainers: null
            volumes:
            - name: tls
              secret:
                secretName: managed-tls
        deployments:
        - deployment
        replicas:
        - deployment-rs
        daemonsets:
        - daemon
        statefulsets:
        - stateful