apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
  name: restrict-zot-image-pulls
policies:
  - ../../policies/restrict-zot-image-pulls.yaml
resources:
  - resources.yaml
results:
  - policy: restrict-zot-image-pulls
    rule: deny-unapproved-zot-images
    kind: Pod
    resources:
      - allowed-quay-bootstrap
      - allowed-postgres
      - allowed-non-zot
    result: pass
  - policy: restrict-zot-image-pulls
    rule: deny-unapproved-zot-images
    kind: Pod
    resources:
      - blocked-container
      - blocked-init-container
      - blocked-ephemeral-container
      - blocked-quay-lookalike
      - blocked-postgres-lookalike
      - blocked-explicit-port
      - blocked-uppercase-host
    result: fail
  - policy: restrict-zot-image-pulls
    rule: autogen-deny-unapproved-zot-images
    kind: Deployment
    resources:
      - blocked-deployment
    result: fail
  - policy: restrict-zot-image-pulls
    rule: autogen-cronjob-deny-unapproved-zot-images
    kind: CronJob
    resources:
      - blocked-cronjob
    result: fail