130 lines
3 KiB
YAML
130 lines
3 KiB
YAML
apiVersion: cli.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: baseline-enforce
|
|
policies:
|
|
- ../../policies/require-app-labels.yaml
|
|
- ../../policies/deny-latest-tag.yaml
|
|
- ../../policies/deny-privileged.yaml
|
|
- ../../policies/require-drop-all-capabilities.yaml
|
|
- ../../policies/require-allow-privilege-escalation-false.yaml
|
|
- ../../policies/require-resource-requests.yaml
|
|
resources:
|
|
- resources.yaml
|
|
results:
|
|
- policy: require-app-labels
|
|
rule: require-app-name-and-instance
|
|
kind: Pod
|
|
resources:
|
|
- good-pod
|
|
result: pass
|
|
- policy: deny-latest-tag
|
|
rule: deny-latest-images
|
|
kind: Pod
|
|
resources:
|
|
- good-pod
|
|
result: pass
|
|
- policy: deny-privileged
|
|
rule: deny-privileged-containers
|
|
kind: Pod
|
|
resources:
|
|
- good-pod
|
|
result: pass
|
|
- policy: require-drop-all-capabilities
|
|
rule: require-capabilities-drop-all
|
|
kind: Pod
|
|
resources:
|
|
- good-pod
|
|
result: pass
|
|
- policy: require-allow-privilege-escalation-false
|
|
rule: require-allow-privilege-escalation-false
|
|
kind: Pod
|
|
resources:
|
|
- good-pod
|
|
result: pass
|
|
- policy: require-resource-requests
|
|
rule: require-cpu-memory-requests
|
|
kind: Pod
|
|
resources:
|
|
- good-pod
|
|
result: pass
|
|
- policy: require-resource-requests
|
|
rule: require-cpu-memory-requests
|
|
kind: Pod
|
|
resources:
|
|
- debug-ephemeral-container
|
|
result: pass
|
|
|
|
- policy: require-app-labels
|
|
rule: require-app-name-and-instance
|
|
kind: Pod
|
|
resources:
|
|
- bad-labels
|
|
result: fail
|
|
- policy: deny-latest-tag
|
|
rule: deny-latest-images
|
|
kind: Pod
|
|
resources:
|
|
- bad-latest
|
|
result: fail
|
|
- policy: deny-privileged
|
|
rule: deny-privileged-containers
|
|
kind: Pod
|
|
resources:
|
|
- bad-privileged
|
|
result: fail
|
|
- policy: require-drop-all-capabilities
|
|
rule: require-capabilities-drop-all
|
|
kind: Pod
|
|
resources:
|
|
- bad-caps
|
|
result: fail
|
|
- policy: require-allow-privilege-escalation-false
|
|
rule: require-allow-privilege-escalation-false
|
|
kind: Pod
|
|
resources:
|
|
- bad-ape
|
|
result: fail
|
|
- policy: require-resource-requests
|
|
rule: require-cpu-memory-requests
|
|
kind: Pod
|
|
resources:
|
|
- bad-requests
|
|
result: fail
|
|
|
|
- policy: require-app-labels
|
|
rule: require-app-name-and-instance
|
|
kind: Pod
|
|
resources:
|
|
- excluded-ns
|
|
result: skip
|
|
- policy: deny-latest-tag
|
|
rule: deny-latest-images
|
|
kind: Pod
|
|
resources:
|
|
- excluded-ns
|
|
result: skip
|
|
- policy: deny-privileged
|
|
rule: deny-privileged-containers
|
|
kind: Pod
|
|
resources:
|
|
- excluded-ns
|
|
result: skip
|
|
- policy: require-drop-all-capabilities
|
|
rule: require-capabilities-drop-all
|
|
kind: Pod
|
|
resources:
|
|
- excluded-ns
|
|
result: skip
|
|
- policy: require-allow-privilege-escalation-false
|
|
rule: require-allow-privilege-escalation-false
|
|
kind: Pod
|
|
resources:
|
|
- excluded-ns
|
|
result: skip
|
|
- policy: require-resource-requests
|
|
rule: require-cpu-memory-requests
|
|
kind: Pod
|
|
resources:
|
|
- excluded-ns
|
|
result: skip
|