index.spec.ts.snap

// Jest Snapshot v1, https://goo.gl/fbAQLP

exports[`parse should parse a json object 1`] = `
{
  "apiVersion": "policy/v1beta1",
  "kind": "PodSecurityPolicy",
  "metadata": {
    "name": "policy",
  },
  "spec": {
    "fsGroup": {
      "rule": "RunAsAny",
    },
    "runAsUser": {
      "rule": "RunAsAny",
    },
    "seLinux": {
      "rule": "RunAsAny",
    },
    "supplementalGroups": {
      "rule": "RunAsAny",
    },
    "volumes": [
      "*",
    ],
  },
}
`;

exports[`parse should parse a yaml object 1`] = `
{
  "apiVersion": "policy/v1beta1",
  "kind": "PodSecurityPolicy",
  "metadata": {
    "name": "policy",
  },
  "spec": {
    "fsGroup": {
      "rule": "RunAsAny",
    },
    "runAsUser": {
      "rule": "RunAsAny",
    },
    "seLinux": {
      "rule": "RunAsAny",
    },
    "supplementalGroups": {
      "rule": "RunAsAny",
    },
    "volumes": [
      "*",
    ],
  },
}
`;

exports[`transform_gatekeeper allowPrivilegeEscalation 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPAllowPrivilegeEscalationContainer",
    "metadata": {
      "name": "psp-k8spspallowprivilegeescalationcontainer",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": null,
    },
  },
]
`;

exports[`transform_gatekeeper allowedCapabilities 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPCapabilities",
    "metadata": {
      "name": "psp-k8spspcapabilities",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "allowedCapabilities": [
          "something",
        ],
        "requiredDropCapabilities": [],
      },
    },
  },
]
`;

exports[`transform_gatekeeper allowedFlexVolumes 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPFlexVolumes",
    "metadata": {
      "name": "psp-k8spspflexvolumes",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "allowedFlexVolumes": [
          {
            "driver": "example/lvm",
          },
        ],
      },
    },
  },
]
`;

exports[`transform_gatekeeper allowedHostPaths 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPPrivilegedContainer",
    "metadata": {
      "name": "psp-k8spspprivilegedcontainer",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": null,
    },
  },
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPHostFilesystem",
    "metadata": {
      "name": "psp-k8spsphostfilesystem",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "allowedHostPaths": [
          {
            "pathPrefix": "/foo",
            "readOnly": true,
          },
        ],
      },
    },
  },
]
`;

exports[`transform_gatekeeper allowedProcMountTypes 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPPrivilegedContainer",
    "metadata": {
      "name": "psp-k8spspprivilegedcontainer",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": null,
    },
  },
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPProcMount",
    "metadata": {
      "name": "psp-k8spspprocmount",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "procMount": "Default",
      },
    },
  },
]
`;

exports[`transform_gatekeeper allowedUnsafeSysctls 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPForbiddenSysctls",
    "metadata": {
      "name": "psp-k8spspforbiddensysctls",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "allowedSysctls": [
          "kernel.msgmax",
        ],
        "forbiddenSysctls": null,
      },
    },
  },
]
`;

exports[`transform_gatekeeper apparmor 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPAppArmor",
    "metadata": {
      "name": "psp-k8spspapparmor",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "allowedProfiles": [
          "runtime/default",
        ],
      },
    },
  },
]
`;

exports[`transform_gatekeeper defaultAddCapabilities 1`] = `
[
  {
    "apiVersion": "mutations.gatekeeper.sh/v1beta1",
    "kind": "ModifySet",
    "metadata": {
      "name": "psp-k8spspdefaultaddcapabilities",
    },
    "spec": {
      "applyTo": [
        {
          "groups": [
            "",
          ],
          "kinds": [
            "Pod",
          ],
          "versions": [
            "v1",
          ],
        },
      ],
      "location": "spec.containers[name:*].securityContext.capabilities.add",
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "*",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
        "scope": "Namespaced",
      },
      "parameters": {
        "values": {
          "fromList": [
            "something",
          ],
        },
      },
    },
  },
]
`;

exports[`transform_gatekeeper defaultAllowPrivilegeEscalation 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPAllowPrivilegeEscalationContainer",
    "metadata": {
      "name": "psp-k8spspallowprivilegeescalationcontainer",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": null,
    },
  },
  {
    "apiVersion": "mutations.gatekeeper.sh/v1beta1",
    "kind": "Assign",
    "metadata": {
      "name": "psp-k8spspdefaultallowprivilegeescalation",
    },
    "spec": {
      "applyTo": [
        {
          "groups": [
            "",
          ],
          "kinds": [
            "Pod",
          ],
          "versions": [
            "v1",
          ],
        },
      ],
      "location": "spec.containers[name:*].securityContext.allowPrivilegeEscalation",
      "parameters": {
        "assign": {
          "value": false,
        },
        "pathTests": [
          {
            "condition": "MustNotExist",
            "subPath": "spec.containers[name:*].securityContext.allowPrivilegeEscalation",
          },
        ],
      },
    },
  },
  {
    "apiVersion": "mutations.gatekeeper.sh/v1beta1",
    "kind": "Assign",
    "metadata": {
      "name": "psp-k8spspdefaultallowprivilegeescalation-init",
    },
    "spec": {
      "applyTo": [
        {
          "groups": [
            "",
          ],
          "kinds": [
            "Pod",
          ],
          "versions": [
            "v1",
          ],
        },
      ],
      "location": "spec.initContainers[name:*].securityContext.allowPrivilegeEscalation",
      "parameters": {
        "assign": {
          "value": false,
        },
        "pathTests": [
          {
            "condition": "MustNotExist",
            "subPath": "spec.initContainers[name:*].securityContext.allowPrivilegeEscalation",
          },
        ],
      },
    },
  },
]
`;

exports[`transform_gatekeeper forbiddenSysctls 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPForbiddenSysctls",
    "metadata": {
      "name": "psp-k8spspforbiddensysctls",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "allowedSysctls": null,
        "forbiddenSysctls": [
          "kernel.m*",
        ],
      },
    },
  },
]
`;

exports[`transform_gatekeeper fsgroup 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPPrivilegedContainer",
    "metadata": {
      "name": "psp-k8spspprivilegedcontainer",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": null,
    },
  },
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPAllowedUsers",
    "metadata": {
      "name": "psp-k8spspallowedusers",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "fsGroup": {
          "ranges": [
            {
              "max": 200,
              "min": 100,
            },
          ],
          "rule": "MustRunAs",
        },
      },
    },
  },
]
`;

exports[`transform_gatekeeper hostIPC 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPHostNamespace",
    "metadata": {
      "name": "psp-k8spsphostnamespace",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": null,
    },
  },
]
`;

exports[`transform_gatekeeper hostNetwork 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPHostNetworkingPorts",
    "metadata": {
      "name": "psp-k8spsphostnetworkingports",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "hostNetwork": false,
      },
    },
  },
]
`;

exports[`transform_gatekeeper hostPID 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPHostNamespace",
    "metadata": {
      "name": "psp-k8spsphostnamespace",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": null,
    },
  },
]
`;

exports[`transform_gatekeeper hostPorts 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPHostNetworkingPorts",
    "metadata": {
      "name": "psp-k8spsphostnetworkingports",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "hostNetwork": true,
        "max": 9000,
        "min": 80,
      },
    },
  },
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPHostNetworkingPorts",
    "metadata": {
      "name": "psp-k8spsphostnetworkingports",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "hostNetwork": false,
      },
    },
  },
]
`;

exports[`transform_gatekeeper privileged 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPPrivilegedContainer",
    "metadata": {
      "name": "psp-k8spspprivilegedcontainer",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": null,
    },
  },
]
`;

exports[`transform_gatekeeper readOnlyRootFilesystem 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPReadOnlyRootFilesystem",
    "metadata": {
      "name": "psp-k8spspreadonlyrootfilesystem",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": null,
    },
  },
]
`;

exports[`transform_gatekeeper requiredDropCapabilities 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPCapabilities",
    "metadata": {
      "name": "psp-k8spspcapabilities",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "allowedCapabilities": [],
        "requiredDropCapabilities": [
          "something",
        ],
      },
    },
  },
]
`;

exports[`transform_gatekeeper runAsGroup 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPPrivilegedContainer",
    "metadata": {
      "name": "psp-k8spspprivilegedcontainer",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": null,
    },
  },
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPAllowedUsers",
    "metadata": {
      "name": "psp-k8spspallowedusers",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "runAsGroup": {
          "ranges": [
            {
              "max": 200,
              "min": 100,
            },
          ],
          "rule": "MustRunAs",
        },
      },
    },
  },
]
`;

exports[`transform_gatekeeper runAsUser 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPPrivilegedContainer",
    "metadata": {
      "name": "psp-k8spspprivilegedcontainer",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": null,
    },
  },
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPAllowedUsers",
    "metadata": {
      "name": "psp-k8spspallowedusers",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "runAsUser": {
          "ranges": [
            {
              "max": 200,
              "min": 100,
            },
          ],
          "rule": "MustRunAs",
        },
      },
    },
  },
]
`;

exports[`transform_gatekeeper seLinux 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPSELinuxV2",
    "metadata": {
      "name": "psp-k8spspselinuxv2",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "allowedSELinuxOptions": [
          {
            "level": "s0:c123,c456",
            "role": "object_r",
            "type": "svirt_sandbox_file_t",
            "user": "system_u",
          },
        ],
      },
    },
  },
]
`;

exports[`transform_gatekeeper seccomp 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPSeccomp",
    "metadata": {
      "name": "psp-k8spspseccomp",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "allowedProfiles": [
          "runtime/default",
          "docker/default",
        ],
      },
    },
  },
]
`;

exports[`transform_gatekeeper supplementalGroups 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPPrivilegedContainer",
    "metadata": {
      "name": "psp-k8spspprivilegedcontainer",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": null,
    },
  },
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPAllowedUsers",
    "metadata": {
      "name": "psp-k8spspallowedusers",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "supplementalGroups": {
          "ranges": [
            {
              "max": 200,
              "min": 100,
            },
          ],
          "rule": "MustRunAs",
        },
      },
    },
  },
]
`;

exports[`transform_gatekeeper volumes 1`] = `
[
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPPrivilegedContainer",
    "metadata": {
      "name": "psp-k8spspprivilegedcontainer",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": null,
    },
  },
  {
    "apiVersion": "constraints.gatekeeper.sh/v1beta1",
    "kind": "K8sPSPVolumeTypes",
    "metadata": {
      "name": "psp-k8spspvolumetypes",
    },
    "spec": {
      "match": {
        "kinds": [
          {
            "apiGroups": [
              "",
            ],
            "kinds": [
              "Pod",
            ],
          },
        ],
      },
      "parameters": {
        "volumes": [
          "projected",
          "emptyDir",
        ],
      },
    },
  },
]
`;

exports[`transform_kubewarden allowPrivilegeEscalation 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-defaultallowprivilegeescalation",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/allow-privilege-escalation-psp:v0.2.7",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "default_allow_privilege_escalation": false,
      },
    },
  },
]
`;

exports[`transform_kubewarden allowedCapabilities 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-capabilities",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/capabilities-psp:v0.1.16",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allowed_capabilities": [
          "something",
        ],
        "default_add_capabilities": undefined,
        "required_drop_capabilities": undefined,
      },
    },
  },
]
`;

exports[`transform_kubewarden allowedFlexVolumes 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-allowedflexvolumes",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/flexvolume-drivers-psp:v0.1.7",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allowedFlexVolumes": [
          {
            "driver": "example/lvm",
          },
        ],
      },
    },
  },
]
`;

exports[`transform_kubewarden allowedHostPaths 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-allowedhostpaths",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/hostpaths-psp:v0.1.11",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allowedHostPaths": [
          {
            "pathPrefix": "/foo",
            "readOnly": true,
          },
        ],
      },
    },
  },
]
`;

exports[`transform_kubewarden allowedProcMountTypes 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-allowedprocmounttypes",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/allowed-proc-mount-types-psp:v0.1.11",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_unmasked_proc_mount_type": false,
      },
    },
  },
]
`;

exports[`transform_kubewarden allowedUnsafeSysctls 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-allowedprocmounttypes",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/sysctl-psp:v0.1.12",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allowedUnsafeSysctls": [
          "kernel.msgmax",
        ],
        "forbiddenSysctls": undefined,
      },
    },
  },
]
`;

exports[`transform_kubewarden apparmor 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-apparmor",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/apparmor-psp:v0.1.13",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allowed_profiles": [
          "runtime/default",
        ],
      },
    },
  },
]
`;

exports[`transform_kubewarden defaultAddCapabilities 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-capabilities",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/capabilities-psp:v0.1.16",
      "mutating": true,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allowed_capabilities": [
          "something",
        ],
        "default_add_capabilities": [
          "something",
        ],
        "required_drop_capabilities": undefined,
      },
    },
  },
]
`;

exports[`transform_kubewarden defaultAllowPrivilegeEscalation 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-defaultallowprivilegeescalation",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/allow-privilege-escalation-psp:v0.2.7",
      "mutating": true,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "default_allow_privilege_escalation": false,
      },
    },
  },
]
`;

exports[`transform_kubewarden forbiddenSysctls 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-allowedprocmounttypes",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/sysctl-psp:v0.1.12",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allowedUnsafeSysctls": undefined,
        "forbiddenSysctls": [
          "kernel.m*",
        ],
      },
    },
  },
]
`;

exports[`transform_kubewarden fsgroup 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-fsgroup",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/allowed-fsgroups-psp:v0.1.10",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "ranges": [
          {
            "max": 200,
            "min": 100,
          },
        ],
        "rule": "MustRunAs",
      },
    },
  },
]
`;

exports[`transform_kubewarden hostIPC 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
]
`;

exports[`transform_kubewarden hostNetwork 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
]
`;

exports[`transform_kubewarden hostPID 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
]
`;

exports[`transform_kubewarden hostPorts 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": [
          {
            "max": 9000,
            "min": 80,
          },
        ],
      },
    },
  },
]
`;

exports[`transform_kubewarden privileged 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
]
`;

exports[`transform_kubewarden readOnlyRootFilesystem 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-readonlyrootfilesystem",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/readonly-root-filesystem-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
]
`;

exports[`transform_kubewarden requiredDropCapabilities 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-capabilities",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/capabilities-psp:v0.1.16",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allowed_capabilities": [],
        "default_add_capabilities": undefined,
        "required_drop_capabilities": [
          "something",
        ],
      },
    },
  },
]
`;

exports[`transform_kubewarden runAsGroup 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-usergroup",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/user-group-psp:v0.6.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "run_as_group": {
          "ranges": [
            {
              "max": 200,
              "min": 100,
            },
          ],
          "rule": "MustRunAs",
        },
        "run_as_user": {
          "rule": "RunAsAny",
        },
        "supplemental_groups": {
          "rule": "RunAsAny",
        },
      },
    },
  },
]
`;

exports[`transform_kubewarden runAsUser 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-usergroup",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/user-group-psp:v0.6.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "run_as_group": undefined,
        "run_as_user": {
          "ranges": [
            {
              "max": 200,
              "min": 100,
            },
          ],
          "rule": "MustRunAs",
        },
        "supplemental_groups": {
          "rule": "RunAsAny",
        },
      },
    },
  },
]
`;

exports[`transform_kubewarden seLinux 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-selinux",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/selinux-psp:v0.1.12",
      "mutating": true,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "level": "s0:c123,c456",
        "role": "object_r",
        "rule": "MustRunAs",
        "type": "svirt_sandbox_file_t",
        "user": "system_u",
      },
    },
  },
]
`;

exports[`transform_kubewarden seccomp 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-seccomp",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/seccomp-psp:v0.1.4",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allowed_profiles": [
          "runtime/default",
          "docker/default",
        ],
        "localhost_profiles": [],
        "profile_types": [
          "RuntimeDefault",
        ],
      },
    },
  },
]
`;

exports[`transform_kubewarden supplementalGroups 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-usergroup",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/user-group-psp:v0.6.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "run_as_group": undefined,
        "run_as_user": {
          "rule": "RunAsAny",
        },
        "supplemental_groups": {
          "ranges": [
            {
              "max": 200,
              "min": 100,
            },
          ],
          "rule": "MustRunAs",
        },
      },
    },
  },
]
`;

exports[`transform_kubewarden volumes 1`] = `
[
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.3",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": null,
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-hostnamespaces",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allow_host_ipc": false,
        "allow_host_network": false,
        "allow_host_pid": false,
        "allow_host_ports": undefined,
      },
    },
  },
  {
    "apiVersion": "policies.kubewarden.io/v1",
    "kind": "ClusterAdmissionPolicy",
    "metadata": {
      "name": "psp-volumes",
    },
    "spec": {
      "module": "registry://ghcr.io/kubewarden/policies/volumes-psp:v0.1.11",
      "mutating": false,
      "rules": [
        {
          "apiGroups": [
            "",
          ],
          "apiVersions": [
            "v1",
          ],
          "operations": [
            "CREATE",
            "UPDATE",
          ],
          "resources": [
            "pods",
          ],
        },
      ],
      "settings": {
        "allowedTypes": [
          "projected",
          "emptyDir",
        ],
      },
    },
  },
]
`;

exports[`transform_kyverno allowPrivilegeEscalation 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-allowprivilegeescalation",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-allowprivilegeescalation-0",
          "validate": {
            "message": "Rejected by psp-allowprivilegeescalation-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "=(securityContext)": {
                      "=(allowPrivilegeEscalation)": false,
                    },
                  },
                ],
                "=(initContainers)": [
                  {
                    "=(securityContext)": {
                      "=(allowPrivilegeEscalation)": false,
                    },
                  },
                ],
                "containers": [
                  {
                    "=(securityContext)": {
                      "=(allowPrivilegeEscalation)": false,
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno allowedCapabilities 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-allowedcapabilities",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-allowedcapabilities-0",
          "preconditions": {
            "all": [
              {
                "key": "{{ request.object.spec.initContainers[] | length(@) }}",
                "operator": "GreaterThanOrEquals",
                "value": 1,
              },
            ],
          },
          "validate": {
            "foreach": [
              {
                "deny": {
                  "conditions": {
                    "any": [
                      {
                        "key": "{{ element.add }}",
                        "operator": "AnyNotIn",
                        "value": [
                          "something",
                        ],
                      },
                    ],
                  },
                },
                "list": "request.object.spec.initContainers[].securityContext.capabilities",
              },
            ],
            "message": "Rejected by psp-allowedcapabilities-0 rule",
          },
        },
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-allowedcapabilities-1",
          "validate": {
            "foreach": [
              {
                "deny": {
                  "conditions": {
                    "any": [
                      {
                        "key": "{{ element.add }}",
                        "operator": "AnyNotIn",
                        "value": [
                          "something",
                        ],
                      },
                    ],
                  },
                },
                "list": "request.object.spec.containers[].securityContext.capabilities",
              },
            ],
            "message": "Rejected by psp-allowedcapabilities-1 rule",
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno allowedFlexVolumes 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-allowedflexvolumes",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-allowedflexvolumes-0",
          "validate": {
            "message": "Rejected by psp-allowedflexvolumes-0 rule",
            "pattern": {
              "spec": {
                "=(volumes)": [
                  {
                    "=(flexVolume)": {
                      "driver": "example/lvm",
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno allowedHostPaths 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-privileged-0",
          "validate": {
            "message": "Rejected by psp-privileged-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "=(initContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "containers": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-allowedhostpaths",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-allowedhostpaths-0",
          "preconditions": {
            "all": [
              {
                "key": "{{ request.object.spec.volumes[?hostPath] | length(@) }}",
                "operator": "GreaterThanOrEquals",
                "value": 1,
              },
            ],
          },
          "validate": {
            "foreach": [
              {
                "deny": {
                  "conditions": [
                    {
                      "key": "{{ element.path  | to_string(@) | split(@, '/') | [1] }}",
                      "operator": "NotEquals",
                      "value": "foo",
                    },
                  ],
                },
                "list": "request.object.spec.volumes[?hostPath].hostPath",
              },
            ],
            "message": "Rejected by psp-allowedhostpaths-0 rule",
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno allowedProcMountTypes 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-privileged-0",
          "validate": {
            "message": "Rejected by psp-privileged-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "=(initContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "containers": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-allowedprocmounttypes",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-allowedprocmounttypes-0",
          "validate": {
            "message": "Rejected by psp-allowedprocmounttypes-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "=(securityContext)": {
                      "=(procMount)": "Default",
                    },
                  },
                ],
                "=(initContainers)": [
                  {
                    "=(securityContext)": {
                      "=(procMount)": "Default",
                    },
                  },
                ],
                "containers": [
                  {
                    "=(securityContext)": {
                      "=(procMount)": "Default",
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno allowedUnsafeSysctls 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-allowedunsafesysctls",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-allowedunsafesysctls-0",
          "validate": {
            "anyPattern": [
              {
                "spec": {
                  "=(securityContext)": {
                    "=(sysctls)": [
                      {
                        "name": "kernel.msgmax",
                      },
                    ],
                  },
                },
              },
              {
                "spec": {
                  "containers": {
                    "securitycontext": {
                      "=(securityContext)": {
                        "=(sysctls)": [
                          {
                            "name": "kernel.msgmax",
                          },
                        ],
                      },
                    },
                  },
                },
              },
            ],
            "message": "Rejected by psp-allowedunsafesysctls-0 rule",
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno apparmor 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-apparmor",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-apparmor-0",
          "validate": {
            "message": "Rejected by psp-apparmor-0 rule",
            "pattern": {
              "metadata": {
                "=(annotations)": {
                  "=(container.apparmor.security.beta.kubernetes.io/*)": "runtime/default",
                },
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno defaultAddCapabilities 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-defaultaddcapabilities",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "mutate": {
            "patchesJson6902": "
- op: add
  path: "/spec/securityContext/capabilities/add/-"
  value: something",
          },
          "name": "psp-defaultaddcapabilities-0",
        },
      ],
      "schemaValidation": false,
    },
  },
]
`;

exports[`transform_kyverno defaultAllowPrivilegeEscalation 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-allowprivilegeescalation",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-allowprivilegeescalation-0",
          "validate": {
            "message": "Rejected by psp-allowprivilegeescalation-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "=(securityContext)": {
                      "=(allowPrivilegeEscalation)": false,
                    },
                  },
                ],
                "=(initContainers)": [
                  {
                    "=(securityContext)": {
                      "=(allowPrivilegeEscalation)": false,
                    },
                  },
                ],
                "containers": [
                  {
                    "=(securityContext)": {
                      "=(allowPrivilegeEscalation)": false,
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-defaultallowprivilegeescalation",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "mutate": {
            "patchesJson6902": "
- op: add
  path: "/spec/securityContext/allowPrivilegeEscalation"
  value: false",
          },
          "name": "psp-defaultallowprivilegeescalation-0",
        },
      ],
      "schemaValidation": false,
    },
  },
]
`;

exports[`transform_kyverno forbiddenSysctls 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-forbiddensysctls",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-forbiddensysctls-0",
          "validate": {
            "anyPattern": [
              {
                "spec": {
                  "=(securityContext)": {
                    "=(sysctls)": [
                      {
                        "name": "!kernel.m*",
                      },
                    ],
                  },
                },
              },
              {
                "spec": {
                  "containers": {
                    "=(securityContext)": {
                      "=(sysctls)": [
                        {
                          "name": "!kernel.m*",
                        },
                      ],
                    },
                  },
                },
              },
            ],
            "message": "Rejected by psp-forbiddensysctls-0 rule",
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno fsgroup 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-privileged-0",
          "validate": {
            "message": "Rejected by psp-privileged-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "=(initContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "containers": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-fsgroup",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-fsgroup-0",
          "validate": {
            "anyPattern": [
              {
                "spec": {
                  "securityContext": {
                    "fsGroup": ">=100 & <=200",
                  },
                },
              },
              {
                "spec": {
                  "=(ephemeralContainers)": [
                    {
                      "securityContext": {
                        "fsGroup": ">=100 & <=200",
                      },
                    },
                  ],
                  "=(initContainers)": [
                    {
                      "securityContext": {
                        "fsGroup": ">=100 & <=200",
                      },
                    },
                  ],
                  "=(securityContext)": {
                    "=(fsGroup)": ">=100 & <=200",
                  },
                  "containers": [
                    {
                      "securityContext": {
                        "fsGroup": ">=100 & <=200",
                      },
                    },
                  ],
                },
              },
            ],
            "message": "Rejected by psp-fsgroup-0 rule",
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno hostIPC 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-hostipc",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-hostipc-0",
          "validate": {
            "message": "Rejected by psp-hostipc-0 rule",
            "pattern": {
              "spec": {
                "=(hostIPC)": false,
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno hostNetwork 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-hostnetwork",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-hostnetwork-0",
          "validate": {
            "message": "Rejected by psp-hostnetwork-0 rule",
            "pattern": {
              "spec": {
                "=(hostNetwork)": false,
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno hostPID 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-hostpid",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-hostpid-0",
          "validate": {
            "message": "Rejected by psp-hostpid-0 rule",
            "pattern": {
              "spec": {
                "=(hostPID)": false,
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno hostPorts 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-hostports",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-hostports-0",
          "validate": {
            "message": "Rejected by psp-hostports-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "=(ports)": [
                      {
                        "=(hostPort)": ">=80 & <=9000",
                      },
                    ],
                  },
                ],
                "=(initContainers)": [
                  {
                    "=(ports)": [
                      {
                        "=(hostPort)": ">=80 & <=9000",
                      },
                    ],
                  },
                ],
                "containers": [
                  {
                    "=(ports)": [
                      {
                        "=(hostPort)": ">=80 & <=9000",
                      },
                    ],
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-hostnetwork",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-hostnetwork-0",
          "validate": {
            "message": "Rejected by psp-hostnetwork-0 rule",
            "pattern": {
              "spec": {
                "=(hostNetwork)": false,
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno privileged 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-privileged-0",
          "validate": {
            "message": "Rejected by psp-privileged-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "=(initContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "containers": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno readOnlyRootFilesystem 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-readonlyrootfilesystem",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-readonlyrootfilesystem-0",
          "validate": {
            "message": "Rejected by psp-readonlyrootfilesystem-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "=(securityContext)": {
                      "=(readOnlyRootFilesystem)": true,
                    },
                  },
                ],
                "=(initContainers)": [
                  {
                    "=(securityContext)": {
                      "=(readOnlyRootFilesystem)": true,
                    },
                  },
                ],
                "containers": [
                  {
                    "=(securityContext)": {
                      "=(readOnlyRootFilesystem)": true,
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno requiredDropCapabilities 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-requireddropcapabilities",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-requireddropcapabilities-0",
          "validate": {
            "message": "Rejected by psp-requireddropcapabilities-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "securityContext": {
                      "capabilities": {
                        "drop": [
                          "something",
                        ],
                      },
                    },
                  },
                ],
                "=(initContainers)": [
                  {
                    "securityContext": {
                      "capabilities": {
                        "drop": [
                          "something",
                        ],
                      },
                    },
                  },
                ],
                "containers": [
                  {
                    "securityContext": {
                      "capabilities": {
                        "drop": [
                          "something",
                        ],
                      },
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno runAsGroup 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-privileged-0",
          "validate": {
            "message": "Rejected by psp-privileged-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "=(initContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "containers": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-runasgroup",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-runasgroup-0",
          "validate": {
            "anyPattern": [
              {
                "spec": {
                  "securityContext": {
                    "runAsGroup": ">=100 & <=200",
                  },
                },
              },
              {
                "spec": {
                  "=(ephemeralContainers)": [
                    {
                      "securityContext": {
                        "runAsGroup": ">=100 & <=200",
                      },
                    },
                  ],
                  "=(initContainers)": [
                    {
                      "securityContext": {
                        "runAsGroup": ">=100 & <=200",
                      },
                    },
                  ],
                  "=(securityContext)": {
                    "=(runAsGroup)": ">=100 & <=200",
                  },
                  "containers": [
                    {
                      "securityContext": {
                        "runAsGroup": ">=100 & <=200",
                      },
                    },
                  ],
                },
              },
            ],
            "message": "Rejected by psp-runasgroup-0 rule",
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno runAsUser 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-privileged-0",
          "validate": {
            "message": "Rejected by psp-privileged-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "=(initContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "containers": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-runasuser",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-runasuser-0",
          "validate": {
            "anyPattern": [
              {
                "spec": {
                  "securityContext": {
                    "runAsUser": ">=100 & <=200",
                  },
                },
              },
              {
                "spec": {
                  "=(ephemeralContainers)": [
                    {
                      "securityContext": {
                        "runAsUser": ">=100 & <=200",
                      },
                    },
                  ],
                  "=(initContainers)": [
                    {
                      "securityContext": {
                        "runAsUser": ">=100 & <=200",
                      },
                    },
                  ],
                  "=(securityContext)": {
                    "=(runAsUser)": ">=100 & <=200",
                  },
                  "containers": [
                    {
                      "securityContext": {
                        "runAsUser": ">=100 & <=200",
                      },
                    },
                  ],
                },
              },
            ],
            "message": "Rejected by psp-runasuser-0 rule",
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno seLinux 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-selinux",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-selinux-0",
          "validate": {
            "anyPattern": [
              {
                "spec": {
                  "securityContext": {
                    "seLinuxOptions": {
                      "level": "s0:c123,c456",
                      "role": "object_r",
                      "type": "svirt_sandbox_file_t",
                      "user": "system_u",
                    },
                  },
                },
              },
              {
                "spec": {
                  "=(initContainers)": [
                    {
                      "securityContext": {
                        "seLinuxOptions": {
                          "level": "s0:c123,c456",
                          "role": "object_r",
                          "type": "svirt_sandbox_file_t",
                          "user": "system_u",
                        },
                      },
                    },
                  ],
                  "=(securityContext)": {
                    "=(seLinuxOptions)": {
                      "level": "s0:c123,c456",
                      "role": "object_r",
                      "type": "svirt_sandbox_file_t",
                      "user": "system_u",
                    },
                  },
                  "containers": [
                    {
                      "securityContext": {
                        "seLinuxOptions": {
                          "level": "s0:c123,c456",
                          "role": "object_r",
                          "type": "svirt_sandbox_file_t",
                          "user": "system_u",
                        },
                      },
                    },
                  ],
                },
              },
            ],
            "message": "Rejected by psp-selinux-0 rule",
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno seccomp 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-seccomp",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-seccomp-0",
          "validate": {
            "message": "Rejected by psp-seccomp-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "=(securityContext)": {
                      "=(seccompProfile)": {
                        "type": "RuntimeDefault",
                      },
                    },
                  },
                ],
                "=(initContainers)": [
                  {
                    "=(securityContext)": {
                      "=(seccompProfile)": {
                        "type": "RuntimeDefault",
                      },
                    },
                  },
                ],
                "=(securityContext)": {
                  "=(seccompProfile)": {
                    "type": "RuntimeDefault",
                  },
                },
                "containers": [
                  {
                    "=(securityContext)": {
                      "=(seccompProfile)": {
                        "type": "RuntimeDefault",
                      },
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno supplementalGroups 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-privileged-0",
          "validate": {
            "message": "Rejected by psp-privileged-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "=(initContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "containers": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-supplementalgroups",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-supplementalgroups-0",
          "validate": {
            "message": "Rejected by psp-supplementalgroups-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "=(securityContext)": {
                      "=(supplementalGroups)": "100-200",
                    },
                  },
                ],
                "=(initContainers)": [
                  {
                    "=(securityContext)": {
                      "=(supplementalGroups)": "100-200",
                    },
                  },
                ],
                "=(securityContext)": {
                  "=(supplementalGroups)": "100-200",
                },
                "containers": [
                  {
                    "=(securityContext)": {
                      "=(supplementalGroups)": "100-200",
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;

exports[`transform_kyverno volumes 1`] = `
[
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-privileged",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-privileged-0",
          "validate": {
            "message": "Rejected by psp-privileged-0 rule",
            "pattern": {
              "spec": {
                "=(ephemeralContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "=(initContainers)": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
                "containers": [
                  {
                    "=(securityContext)": {
                      "=(privileged)": false,
                    },
                  },
                ],
              },
            },
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
  ClusterPolicy {
    "apiVersion": "kyverno.io/v1",
    "kind": "ClusterPolicy",
    "metadata": {
      "name": "psp-volumes",
    },
    "spec": {
      "rules": [
        {
          "match": {
            "resources": {
              "kinds": [
                "Pod",
              ],
            },
          },
          "name": "psp-volumes-0",
          "preconditions": {
            "all": [
              {
                "key": "{{ request.object.spec.volumes[].keys(@)[] | length(@) }}",
                "operator": "GreaterThan",
                "value": 0,
              },
            ],
          },
          "validate": {
            "deny": {
              "conditions": {
                "all": [
                  {
                    "key": "{{ request.object.spec.volumes[].keys(@)[] }}",
                    "operator": "AnyNotIn",
                    "value": [
                      "name",
                      "projected",
                      "emptyDir",
                    ],
                  },
                ],
              },
            },
            "message": "Rejected by psp-volumes-0 rule",
          },
        },
      ],
      "validationFailureAction": "Enforce",
    },
  },
]
`;