apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
  name: baseline-enforce
policies:
  - ../../policies/require-app-labels.yaml
  - ../../policies/deny-latest-tag.yaml
  - ../../policies/deny-privileged.yaml
  - ../../policies/require-drop-all-capabilities.yaml
  - ../../policies/require-allow-privilege-escalation-false.yaml
  - ../../policies/require-resource-requests.yaml
resources:
  - resources.yaml
results:
  - policy: require-app-labels
    rule: require-app-name-and-instance
    kind: Pod
    resources:
      - good-pod
    result: pass
  - policy: deny-latest-tag
    rule: deny-latest-images
    kind: Pod
    resources:
      - good-pod
    result: pass
  - policy: deny-privileged
    rule: deny-privileged-containers
    kind: Pod
    resources:
      - good-pod
    result: pass
  - policy: require-drop-all-capabilities
    rule: require-capabilities-drop-all
    kind: Pod
    resources:
      - good-pod
    result: pass
  - policy: require-allow-privilege-escalation-false
    rule: require-allow-privilege-escalation-false
    kind: Pod
    resources:
      - good-pod
    result: pass
  - policy: require-resource-requests
    rule: require-cpu-memory-requests
    kind: Pod
    resources:
      - good-pod
    result: pass
  - policy: require-resource-requests
    rule: require-cpu-memory-requests
    kind: Pod
    resources:
      - debug-ephemeral-container
    result: pass

  - policy: require-app-labels
    rule: require-app-name-and-instance
    kind: Pod
    resources:
      - bad-labels
    result: fail
  - policy: deny-latest-tag
    rule: deny-latest-images
    kind: Pod
    resources:
      - bad-latest
    result: fail
  - policy: deny-privileged
    rule: deny-privileged-containers
    kind: Pod
    resources:
      - bad-privileged
    result: fail
  - policy: require-drop-all-capabilities
    rule: require-capabilities-drop-all
    kind: Pod
    resources:
      - bad-caps
    result: fail
  - policy: require-allow-privilege-escalation-false
    rule: require-allow-privilege-escalation-false
    kind: Pod
    resources:
      - bad-ape
    result: fail
  - policy: require-resource-requests
    rule: require-cpu-memory-requests
    kind: Pod
    resources:
      - bad-requests
    result: fail

  - policy: require-app-labels
    rule: require-app-name-and-instance
    kind: Pod
    resources:
      - excluded-ns
    result: skip
  - policy: deny-latest-tag
    rule: deny-latest-images
    kind: Pod
    resources:
      - excluded-ns
    result: skip
  - policy: deny-privileged
    rule: deny-privileged-containers
    kind: Pod
    resources:
      - excluded-ns
    result: skip
  - policy: require-drop-all-capabilities
    rule: require-capabilities-drop-all
    kind: Pod
    resources:
      - excluded-ns
    result: skip
  - policy: require-allow-privilege-escalation-false
    rule: require-allow-privilege-escalation-false
    kind: Pod
    resources:
      - excluded-ns
    result: skip
  - policy: require-resource-requests
    rule: require-cpu-memory-requests
    kind: Pod
    resources:
      - excluded-ns
    result: skip