Skip to content

Commit 70efff4

Browse files
hackeramitkumarhackeramitkumar
committed
added issue-6115 tests
1 parent 8b63cea commit 70efff4

File tree

12 files changed

+186
-15
lines changed

12 files changed

+186
-15
lines changed

‎clusterPolicy.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,4 +52,4 @@ spec:
5252
mutateDigest: false
5353
required: true
5454
verifyDigest: false
55-
validationFailureAction: enforce
55+
validationFailureAction: enforce

‎kyverno-test.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: verify_multiple_resources
2+
policies:
3+
- policy3.yml
4+
resources:
5+
# - pod3.yml
6+
- pod4.yml
7+
variables: values.yml
8+
results:
9+
# - policy: check-image
10+
# rule: check-image
11+
# resource: pod-3
12+
# kind: Pod
13+
# result: pass
14+
- policy: check-image
15+
rule: check-image
16+
resource: pod-4
17+
kind: Pod
18+
result: pass

‎minikube-linux-amd64‎

80 MB
Binary file not shown.

‎pod.yml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
1+
# verified
12
apiVersion: apps/v1
23
kind: Deployment
34
metadata:
4-
name: nginx-deployment
55
labels:
66
app: nginx
7+
name: nginx-deployment
78
spec:
89
replicas: 1
910
selector:
@@ -14,10 +15,7 @@ spec:
1415
labels:
1516
app: nginx
1617
spec:
17-
imagePullSecrets:
18-
- name: regcred
1918
containers:
20-
- name: nginx
21-
image: ghcr.io/hackeramitkumar/test5:app
22-
ports:
23-
- containerPort: 80
19+
- image: ghcr.io/hackeramitkumar/test5:app
20+
name: nginx
21+
resources: {}

‎pod2.yml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
1+
# verfied image
12
apiVersion: apps/v1
23
kind: Deployment
34
metadata:
4-
name: nginx-deployment
55
labels:
66
app: nginx
7+
name: nginx-deployment
78
spec:
89
replicas: 1
910
selector:
@@ -14,10 +15,7 @@ spec:
1415
labels:
1516
app: nginx
1617
spec:
17-
imagePullSecrets:
18-
- name: regcred
1918
containers:
20-
- name: nginx
21-
image: ghcr.io/hackeramitkumar/test5:app2 # NEW VERSION of image
22-
ports:
23-
- containerPort: 80
19+
- image: ghcr.io/hackeramitkumar/test5:app2
20+
name: nginx
21+
resources: {}

‎pod3.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: pod-3
5+
namespace: default
6+
spec:
7+
containers:
8+
- image: ghcr.io/hackeramitkumar/test6:app
9+
name: bad-container
10+
imagePullPolicy: Always
11+
- image: ghcr.io/hackeramitkumar/test5:app
12+
name: good-container
13+
imagePullPolicy: Always

‎pod4.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: pod-4
5+
namespace: default
6+
spec:
7+
containers:
8+
- image: ghcr.io/hackeramitkumar/test5:app
9+
name: good-container
10+
imagePullPolicy: Always
11+
- image: ghcr.io/hackeramitkumar/test6:app
12+
name: bad-container
13+
imagePullPolicy: Always

‎pod5.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
labels:
5+
app: nginx
6+
name: nginx-deployment-5
7+
spec:
8+
replicas: 1
9+
selector:
10+
matchLabels:
11+
app: nginx
12+
template:
13+
metadata:
14+
labels:
15+
app: nginx
16+
spec:
17+
containers:
18+
- image: ghcr.io/hackeramitkumar/test5:app
19+
name: good-container
20+
resources: {}
21+
- image: ghcr.io/hackeramitkumar/test6:app
22+
name: bad-container
23+
resources: {}

‎pod6.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
labels:
5+
app: nginx
6+
name: nginx-deployment-6
7+
spec:
8+
replicas: 1
9+
selector:
10+
matchLabels:
11+
app: nginx
12+
template:
13+
metadata:
14+
labels:
15+
app: nginx
16+
spec:
17+
containers:
18+
- image: ghcr.io/hackeramitkumar/test6:app
19+
name: bad-container
20+
resources: {}
21+
- image: ghcr.io/hackeramitkumar/test5:app
22+
name: good-container
23+
resources: {}

‎policy3.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
apiVersion: kyverno.io/v1
2+
kind: ClusterPolicy
3+
metadata:
4+
name: check-image
5+
spec:
6+
validationFailureAction: Enforce
7+
background: false
8+
webhookTimeoutSeconds: 30
9+
failurePolicy: Fail
10+
rules:
11+
- name: check-image
12+
match:
13+
any:
14+
- resources:
15+
kinds:
16+
- Pod
17+
verifyImages:
18+
- imageReferences:
19+
- "ghcr.io/hackeramitkumar*"
20+
attestors:
21+
- count: 1
22+
entries:
23+
- keys:
24+
publicKeys: |-
25+
-----BEGIN PUBLIC KEY-----
26+
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEFN8gGjQua2g8N+aLx3Eff+/j5HxL
27+
bV+H2z50/0A4d8XyMUvizPQBtcgei43pqLj1850m3wSwI08z2+6zT1QaEg==
28+
-----END PUBLIC KEY-----

0 commit comments

Comments
 (0)