forked from kyverno/policies
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into addPodSecurityBaselineChainsawTest
- Loading branch information
Showing
699 changed files
with
19,778 additions
and
667 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| name: "Runs E2E Tests" | ||
| description: "Runs E2E tests using chainsaw" | ||
| inputs: | ||
| tests: | ||
| description: "Test regex" | ||
| required: true | ||
| runs: | ||
| using: "composite" | ||
| steps: | ||
| - name: Install Chainsaw | ||
| uses: kyverno/action-install-chainsaw@5d00c353f61f44f3b492c673420202d1b1374c3f # v0.2.6 | ||
| - name: Test with Chainsaw | ||
| shell: bash | ||
| run: | | ||
| set -e | ||
| chainsaw test --config .chainsaw.yaml --include-test-regex '^chainsaw$/${{ inputs.tests }}' --no-color=false |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| name: "Setup Environment for E2E Tests" | ||
| description: "Sets up the environment for the E2E workflows" | ||
| inputs: | ||
| k8s-version: | ||
| description: "Kubernetes version" | ||
| required: true | ||
| runs: | ||
| using: "composite" | ||
| steps: | ||
| - name: Setup Go | ||
| uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 | ||
| with: | ||
| go-version: ~1.21.1 | ||
| - name: Install Tools | ||
| shell: bash | ||
| run: | | ||
| set -e | ||
| curl -LO "https://dl.k8s.io/release/${{ inputs.k8s-version }}/bin/linux/amd64/kubectl" | ||
| sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl | ||
| - name: Install kind | ||
| shell: bash | ||
| run: | | ||
| set -e | ||
| # For AMD64 / x86_64 | ||
| [ $(uname -m) = x86_64 ] && curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.20.0/kind-linux-amd64 | ||
| # For ARM64 | ||
| [ $(uname -m) = aarch64 ] && curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.20.0/kind-linux-arm64 | ||
| chmod +x ./kind | ||
| sudo mv ./kind /usr/local/bin/kind | ||
| - name: Install latest Kyverno CLI | ||
| uses: kyverno/action-install-cli@fcee92fca5c883169ef9927acf543e0b5fc58289 # v0.2.0 | ||
| - name: Create kind cluster | ||
| shell: bash | ||
| run: | | ||
| set -e | ||
| kind create cluster --image kindest/node:${{ inputs.k8s-version }} --config ./.github/kind.yml | ||
| - name: Install latest kyverno | ||
| shell: bash | ||
| run: | | ||
| set -e | ||
| kubectl create -f https://github.com/kyverno/kyverno/raw/main/config/install-latest-testing.yaml | ||
| - name: Wait for kyverno ready | ||
| shell: bash | ||
| run: | | ||
| set -e | ||
| kubectl wait --namespace kyverno --for=condition=ready pod --selector '!job-name' --timeout=60s | ||
| - name: Install CRDs | ||
| shell: bash | ||
| run: | | ||
| set -e | ||
| kubectl apply -f ./.chainsaw/crds |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| name: E2E Tests - CEL | ||
|
|
||
| permissions: {} | ||
|
|
||
| on: | ||
| workflow_dispatch: {} | ||
| pull_request: | ||
| branches: | ||
| - 'main' | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| chainsaw: | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| k8s-version: | ||
| - name: v1.25 | ||
| version: v1.25.16 | ||
| - name: v1.26 | ||
| version: v1.26.14 | ||
| - name: v1.27 | ||
| version: v1.27.11 | ||
| - name: v1.28 | ||
| version: v1.28.7 | ||
| - name: v1.29 | ||
| version: v1.29.2 | ||
| tests: | ||
| - ^argo-cel$ | ||
| - ^aws-cel$ | ||
| - ^best-practices-cel$ | ||
| - ^consul-cel$ | ||
| - ^flux-cel$ | ||
| - ^istio-cel$ | ||
| - ^kasten-cel$ | ||
| - ^kubecost-cel$ | ||
| - ^linkerd-cel$ | ||
| - ^nginx-ingress-cel$ | ||
| - ^openshift-cel$ | ||
| - ^other-cel$/^a | ||
| - ^other-cel$/^[b-d] | ||
| - ^other-cel$/^[e-l] | ||
| - ^other-cel$/^[m-q] | ||
| - ^other-cel$/^re[c-q] | ||
| - ^other-cel$/^res | ||
| - ^other-cel$/^[s-z] | ||
| - ^pod-security-cel$ | ||
| - ^psa-cel$ | ||
| - ^traefik-cel$ | ||
| runs-on: ubuntu-latest | ||
| name: ${{ matrix.k8s-version.name }} - ${{ matrix.tests }} | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| - name: Setup Environment | ||
| uses: ./.github/actions/setup-env | ||
| with: | ||
| k8s-version: ${{ matrix.k8s-version.version }} | ||
| - name: Run CEL Tests | ||
| uses: ./.github/actions/run-tests | ||
| with: | ||
| tests: ${{ matrix.tests }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
15 changes: 15 additions & 0 deletions
15
argo-cel/application-field-validation/.chainsaw-test/README.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| ## Description | ||
|
|
||
| This is an automated test of the sample policy in this directory. | ||
|
|
||
| ## Expected Behavior | ||
|
|
||
| A policy report should be generated in which the following results are observed: | ||
|
|
||
| * `badapp01` fails for the rule `source-path-chart` and passes for the rule `destination-server-name` | ||
| * `badapp02` fails for the rule `destination-server-name` and passes for the rule `source-path-chart` | ||
| * `goodapp01` passes for both rules | ||
|
|
||
| ## Reference Issue(s) | ||
|
|
||
| N/A |
31 changes: 31 additions & 0 deletions
31
argo-cel/application-field-validation/.chainsaw-test/bad-application.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| apiVersion: argoproj.io/v1alpha1 | ||
| kind: Application | ||
| metadata: | ||
| name: badapp01 | ||
| namespace: default | ||
| spec: | ||
| project: foo | ||
| source: | ||
| repoURL: https://github.com/argoproj/argocd-example-apps.git | ||
| targetRevision: HEAD | ||
| path: guestbook | ||
| chart: foo | ||
| destination: | ||
| server: https://kubernetes.default.svc | ||
| namespace: guestbook | ||
| --- | ||
| apiVersion: argoproj.io/v1alpha1 | ||
| kind: Application | ||
| metadata: | ||
| name: badapp02 | ||
| namespace: default | ||
| spec: | ||
| project: bar | ||
| source: | ||
| repoURL: https://github.com/argoproj/argocd-example-apps.git | ||
| targetRevision: HEAD | ||
| path: guestbook | ||
| destination: | ||
| server: https://kubernetes.default.svc | ||
| name: foobar | ||
| namespace: guestbook |
35 changes: 35 additions & 0 deletions
35
argo-cel/application-field-validation/.chainsaw-test/chainsaw-test.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| # yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json | ||
| apiVersion: chainsaw.kyverno.io/v1alpha1 | ||
| kind: Test | ||
| metadata: | ||
| creationTimestamp: null | ||
| name: application-field-validation | ||
| spec: | ||
| steps: | ||
| - name: step-01 | ||
| try: | ||
| - assert: | ||
| file: crd-assert.yaml | ||
| - name: step-02 | ||
| try: | ||
| - apply: | ||
| file: ../application-field-validation.yaml | ||
| - patch: | ||
| resource: | ||
| apiVersion: kyverno.io/v1 | ||
| kind: ClusterPolicy | ||
| metadata: | ||
| name: application-field-validation | ||
| spec: | ||
| validationFailureAction: Enforce | ||
| - assert: | ||
| file: policy-ready.yaml | ||
| - name: step-03 | ||
| try: | ||
| - apply: | ||
| file: good-application.yaml | ||
| - apply: | ||
| expect: | ||
| - check: | ||
| ($error != null): true | ||
| file: bad-application.yaml |
Oops, something went wrong.