tests

Signed-off-by: Charles-Edouard Brétéché <[email protected]>
kyverno · Sep 26, 2024 · 39759be · 39759be
1 parent 41241c4
commit 39759be
Show file tree

Hide file tree

Showing 19 changed files with 47 additions and 38 deletions.
diff --git a/pkg/commands/scan/options.go b/pkg/commands/scan/options.go
@@ -111,7 +111,11 @@ func (c *options) run(cmd *cobra.Command, _ []string) error {
 				} else if len(rule.Violations) != 0 {
 					status = "FAILED"
 				}
-				out.println(fmt.Sprintf("- %s (POLICY=%s, RULE=%s, ID=%s)", status, policy.Policy.Name, rule.Rule.Name, rule.Identifier))
+				if rule.Identifier != "" {
+					out.println(fmt.Sprintf("- %s (POLICY=%s, RULE=%s, ID=%s)", status, policy.Policy.Name, rule.Rule.Name, rule.Identifier))
+				} else {
+					out.println(fmt.Sprintf("- %s (POLICY=%s, RULE=%s)", status, policy.Policy.Name, rule.Rule.Name))
+				}
 				if len(rule.Violations) != 0 {
 					out.println(rule.Violations.Error(" "))
 				}

diff --git a/test/commands/scan/bindings/out.txt b/test/commands/scan/bindings/out.txt
@@ -4,5 +4,5 @@ Loading bindings ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- test / foo-bar-4 /  PASSED
+- PASSED (POLICY=test, RULE=foo-bar-4)
 Done
diff --git a/test/commands/scan/cel/out.txt b/test/commands/scan/cel/out.txt
@@ -2,5 +2,5 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- test / foo-bar-4 /  PASSED
+- PASSED (POLICY=test, RULE=foo-bar-4)
 Done
diff --git a/test/commands/scan/dockerfile/out.txt b/test/commands/scan/dockerfile/out.txt
@@ -2,9 +2,9 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- check-dockerfile / deny-external-calls /  FAILED
--> HTTP calls are not allowed
- -> spec.rules[0].assert.all[0].check.~.(Stages[].Commands[].Args[].Value)[0].(contains(@, 'https://') || contains(@, 'http://')): Invalid value: true: Expected value: false
--> wget is not allowed
- -> spec.rules[0].assert.all[3].check.~.(Stages[].Commands[].CmdLine[])[0].(contains(@, 'wget')): Invalid value: true: Expected value: false
+- FAILED (POLICY=check-dockerfile, RULE=deny-external-calls)
+ -> HTTP calls are not allowed (CHECK=spec.rules[0].assert.all[0])
+  -> Invalid value: true: Expected value: false (PATH=~.(Stages[].Commands[].Args[].Value)[0].(contains(@, 'https://') || contains(@, 'http://')))
+ -> wget is not allowed (CHECK=spec.rules[0].assert.all[3])
+  -> Invalid value: true: Expected value: false (PATH=~.(Stages[].Commands[].CmdLine[])[0].(contains(@, 'wget')))
 Done
diff --git a/test/commands/scan/escaped/out.txt b/test/commands/scan/escaped/out.txt
@@ -2,5 +2,5 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- test / foo-bar-4 /  PASSED
+- PASSED (POLICY=test, RULE=foo-bar-4)
 Done
diff --git a/test/commands/scan/foo-bar/out.txt b/test/commands/scan/foo-bar/out.txt
@@ -2,5 +2,5 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- test / foo-bar-4 /  PASSED
+- PASSED (POLICY=test, RULE=foo-bar-4)
 Done
diff --git a/test/commands/scan/payload-yaml/out.txt b/test/commands/scan/payload-yaml/out.txt
@@ -2,7 +2,7 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- required-s3-tags / require-team-tag / aws_s3_bucket.example FAILED
--> Bucket `example` (aws_s3_bucket.example) does not have the required tags {"Team":"Kyverno"}
- -> spec.rules[0].assert.all[0].check.values.tags: Invalid value: map[string]interface {}{"Environment":"Dev", "Name":"My bucket"}: Expected value: map[string]interface {}{"Team":"Kyverno"}
+- FAILED (POLICY=required-s3-tags, RULE=require-team-tag, ID=aws_s3_bucket.example)
+ -> Bucket `example` (aws_s3_bucket.example) does not have the required tags {"Team":"Kyverno"} (CHECK=spec.rules[0].assert.all[0])
+  -> Invalid value: map[string]interface {}{"Environment":"Dev", "Name":"My bucket"}: Expected value: map[string]interface {}{"Team":"Kyverno"} (PATH=values.tags)
 Done
diff --git a/test/commands/scan/pod-all-latest/out.txt b/test/commands/scan/pod-all-latest/out.txt
@@ -2,5 +2,5 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- test / pod-no-latest / webserver PASSED
+- PASSED (POLICY=test, RULE=pod-no-latest, ID=webserver)
 Done
diff --git a/test/commands/scan/pod-no-latest/out.txt b/test/commands/scan/pod-no-latest/out.txt
@@ -2,14 +2,17 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- test / pod-no-latest / webserver FAILED
- -> spec.rules[0].assert.all[0].check.spec.~foo.containers->foos[0].(at($foos, $foo).image)->foo.(ends_with($foo, $tag)): Invalid value: true: Expected value: false
- -> spec.rules[0].assert.all[0].check.spec.~foo.containers->foos[1].(at($foos, $foo).image)->foo.(ends_with($foo, $tag)): Invalid value: true: Expected value: false
- -> spec.rules[0].assert.all[0].check.spec.~foo.containers->foos[2].(at($foos, $foo).image)->foo.(ends_with($foo, $tag)): Invalid value: true: Expected value: false
- -> spec.rules[0].assert.all[1].check.spec.~.containers->foo[0].image.(ends_with(@, ':latest')): Invalid value: true: Expected value: false
- -> spec.rules[0].assert.all[1].check.spec.~.containers->foo[1].image.(ends_with(@, ':latest')): Invalid value: true: Expected value: false
- -> spec.rules[0].assert.all[1].check.spec.~.containers->foo[2].image.(ends_with(@, ':latest')): Invalid value: true: Expected value: false
- -> spec.rules[0].assert.all[2].check.~index.(spec.containers[*].image)->images[0].(ends_with(@, ':latest')): Invalid value: true: Expected value: false
- -> spec.rules[0].assert.all[2].check.~index.(spec.containers[*].image)->images[1].(ends_with(@, ':latest')): Invalid value: true: Expected value: false
- -> spec.rules[0].assert.all[2].check.~index.(spec.containers[*].image)->images[2].(ends_with(@, ':latest')): Invalid value: true: Expected value: false
+- FAILED (POLICY=test, RULE=pod-no-latest, ID=webserver)
+ -> (CHECK=spec.rules[0].assert.all[0])
+  -> Invalid value: true: Expected value: false (PATH=spec.~foo.containers->foos[0].(at($foos, $foo).image)->foo.(ends_with($foo, $tag)))
+  -> Invalid value: true: Expected value: false (PATH=spec.~foo.containers->foos[1].(at($foos, $foo).image)->foo.(ends_with($foo, $tag)))
+  -> Invalid value: true: Expected value: false (PATH=spec.~foo.containers->foos[2].(at($foos, $foo).image)->foo.(ends_with($foo, $tag)))
+ -> (CHECK=spec.rules[0].assert.all[1])
+  -> Invalid value: true: Expected value: false (PATH=spec.~.containers->foo[0].image.(ends_with(@, ':latest')))
+  -> Invalid value: true: Expected value: false (PATH=spec.~.containers->foo[1].image.(ends_with(@, ':latest')))
+  -> Invalid value: true: Expected value: false (PATH=spec.~.containers->foo[2].image.(ends_with(@, ':latest')))
+ -> (CHECK=spec.rules[0].assert.all[2])
+  -> Invalid value: true: Expected value: false (PATH=~index.(spec.containers[*].image)->images[0].(ends_with(@, ':latest')))
+  -> Invalid value: true: Expected value: false (PATH=~index.(spec.containers[*].image)->images[1].(ends_with(@, ':latest')))
+  -> Invalid value: true: Expected value: false (PATH=~index.(spec.containers[*].image)->images[2].(ends_with(@, ':latest')))
 Done
diff --git a/test/commands/scan/scripted/out.txt b/test/commands/scan/scripted/out.txt
@@ -2,5 +2,5 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- test / foo-bar-4 /  PASSED
+- PASSED (POLICY=test, RULE=foo-bar-4)
 Done
diff --git a/test/commands/scan/tf-ec2/out.txt b/test/commands/scan/tf-ec2/out.txt
@@ -2,5 +2,5 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- required-ec2-tags / require-team-tag /  PASSED
+- PASSED (POLICY=required-ec2-tags, RULE=require-team-tag)
 Done
diff --git a/test/commands/scan/tf-ecs-cluster/01-out.txt b/test/commands/scan/tf-ecs-cluster/01-out.txt
@@ -2,5 +2,5 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 3 resources against 1 policy ) ...
-- required-container-insights / required-container-insights /  PASSED
+- PASSED (POLICY=required-container-insights, RULE=required-container-insights)
 Done
diff --git a/test/commands/scan/tf-ecs-cluster/02-out.txt b/test/commands/scan/tf-ecs-cluster/02-out.txt
@@ -2,5 +2,5 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 3 resources against 1 policy ) ...
-- ecs-cluster-enable-logging / ecs-cluster-enable-logging /  PASSED
+- PASSED (POLICY=ecs-cluster-enable-logging, RULE=ecs-cluster-enable-logging)
 Done
diff --git a/test/commands/scan/tf-ecs-service/01-out.txt b/test/commands/scan/tf-ecs-service/01-out.txt
@@ -2,5 +2,5 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- required-latest-platform-fargate / required-latest-platform /  PASSED
+- PASSED (POLICY=required-latest-platform-fargate, RULE=required-latest-platform)
 Done
diff --git a/test/commands/scan/tf-ecs-service/02-out.txt b/test/commands/scan/tf-ecs-service/02-out.txt
@@ -2,5 +2,5 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- ecs-public-ip / ecs-public-ip /  PASSED
+- PASSED (POLICY=ecs-public-ip, RULE=ecs-public-ip)
 Done
diff --git a/test/commands/scan/tf-ecs-task-definition/out.txt b/test/commands/scan/tf-ecs-task-definition/out.txt
@@ -2,5 +2,5 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- fs-read-only / require-fs-read-only /  PASSED
+- PASSED (POLICY=fs-read-only, RULE=require-fs-read-only)
 Done
diff --git a/test/commands/scan/tf-plan/out.txt b/test/commands/scan/tf-plan/out.txt
@@ -2,7 +2,7 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- required-s3-tags / require-team-tag / aws_s3_bucket.example FAILED
--> Bucket `example` (aws_s3_bucket.example) does not have the required tags {"Team":"Kyverno"}
- -> spec.rules[0].assert.all[0].check.values.tags: Invalid value: map[string]interface {}{"Environment":"Dev", "Name":"My bucket"}: Expected value: map[string]interface {}{"Team":"Kyverno"}
+- FAILED (POLICY=required-s3-tags, RULE=require-team-tag, ID=aws_s3_bucket.example)
+ -> Bucket `example` (aws_s3_bucket.example) does not have the required tags {"Team":"Kyverno"} (CHECK=spec.rules[0].assert.all[0])
+  -> Invalid value: map[string]interface {}{"Environment":"Dev", "Name":"My bucket"}: Expected value: map[string]interface {}{"Team":"Kyverno"} (PATH=values.tags)
 Done
diff --git a/test/commands/scan/tf-s3/out.txt b/test/commands/scan/tf-s3/out.txt
@@ -2,6 +2,7 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- s3 / check-tags /  FAILED
- -> spec.rules[0].assert.all[0].check.planned_values.root_module.~.resources[0].values.(keys(tags_all)).(contains(@, 'Team')): Invalid value: false: Expected value: true
+- FAILED (POLICY=s3, RULE=check-tags)
+ -> (CHECK=spec.rules[0].assert.all[0])
+  -> Invalid value: false: Expected value: true (PATH=planned_values.root_module.~.resources[0].values.(keys(tags_all)).(contains(@, 'Team')))
 Done
diff --git a/test/commands/scan/wildcard/out.txt b/test/commands/scan/wildcard/out.txt
@@ -2,6 +2,7 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- required-s3-tags / require-team-tag / bucket1 FAILED
- -> spec.rules[0].assert.all[0].check.tags.(wildcard('?*', Team)): Invalid value: true: Expected value: false
+- FAILED (POLICY=required-s3-tags, RULE=require-team-tag, ID=bucket1)
+ -> (CHECK=spec.rules[0].assert.all[0])
+  -> Invalid value: true: Expected value: false (PATH=tags.(wildcard('?*', Team)))
 Done