Skip to content

Commit 70efff4

Browse files
hackeramitkumarhackeramitkumar
committed
added issue-6115 tests
1 parent 8b63cea commit 70efff4

12 files changed

+186
-15
lines changed

‎clusterPolicy.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -52,4 +52,4 @@ spec:
5252
mutateDigest: false
5353
required: true
5454
verifyDigest: false
55-
validationFailureAction: enforce
55+
validationFailureAction: enforce

‎kyverno-test.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: verify_multiple_resources
2+
policies:
3+
- policy3.yml
4+
resources:
5+
# - pod3.yml
6+
- pod4.yml
7+
variables: values.yml
8+
results:
9+
# - policy: check-image
10+
# rule: check-image
11+
# resource: pod-3
12+
# kind: Pod
13+
# result: pass
14+
- policy: check-image
15+
rule: check-image
16+
resource: pod-4
17+
kind: Pod
18+
result: pass

‎minikube-linux-amd64

80 MB
Binary file not shown.

‎pod.yml

+5-7
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
1+
# verified
12
apiVersion: apps/v1
23
kind: Deployment
34
metadata:
4-
name: nginx-deployment
55
labels:
66
app: nginx
7+
name: nginx-deployment
78
spec:
89
replicas: 1
910
selector:
@@ -14,10 +15,7 @@ spec:
1415
labels:
1516
app: nginx
1617
spec:
17-
imagePullSecrets:
18-
- name: regcred
1918
containers:
20-
- name: nginx
21-
image: ghcr.io/hackeramitkumar/test5:app
22-
ports:
23-
- containerPort: 80
19+
- image: ghcr.io/hackeramitkumar/test5:app
20+
name: nginx
21+
resources: {}

‎pod2.yml

+5-7
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
1+
# verfied image
12
apiVersion: apps/v1
23
kind: Deployment
34
metadata:
4-
name: nginx-deployment
55
labels:
66
app: nginx
7+
name: nginx-deployment
78
spec:
89
replicas: 1
910
selector:
@@ -14,10 +15,7 @@ spec:
1415
labels:
1516
app: nginx
1617
spec:
17-
imagePullSecrets:
18-
- name: regcred
1918
containers:
20-
- name: nginx
21-
image: ghcr.io/hackeramitkumar/test5:app2 # NEW VERSION of image
22-
ports:
23-
- containerPort: 80
19+
- image: ghcr.io/hackeramitkumar/test5:app2
20+
name: nginx
21+
resources: {}

‎pod3.yml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: pod-3
5+
namespace: default
6+
spec:
7+
containers:
8+
- image: ghcr.io/hackeramitkumar/test6:app
9+
name: bad-container
10+
imagePullPolicy: Always
11+
- image: ghcr.io/hackeramitkumar/test5:app
12+
name: good-container
13+
imagePullPolicy: Always

‎pod4.yml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: pod-4
5+
namespace: default
6+
spec:
7+
containers:
8+
- image: ghcr.io/hackeramitkumar/test5:app
9+
name: good-container
10+
imagePullPolicy: Always
11+
- image: ghcr.io/hackeramitkumar/test6:app
12+
name: bad-container
13+
imagePullPolicy: Always

‎pod5.yml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
labels:
5+
app: nginx
6+
name: nginx-deployment-5
7+
spec:
8+
replicas: 1
9+
selector:
10+
matchLabels:
11+
app: nginx
12+
template:
13+
metadata:
14+
labels:
15+
app: nginx
16+
spec:
17+
containers:
18+
- image: ghcr.io/hackeramitkumar/test5:app
19+
name: good-container
20+
resources: {}
21+
- image: ghcr.io/hackeramitkumar/test6:app
22+
name: bad-container
23+
resources: {}

‎pod6.yml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
labels:
5+
app: nginx
6+
name: nginx-deployment-6
7+
spec:
8+
replicas: 1
9+
selector:
10+
matchLabels:
11+
app: nginx
12+
template:
13+
metadata:
14+
labels:
15+
app: nginx
16+
spec:
17+
containers:
18+
- image: ghcr.io/hackeramitkumar/test6:app
19+
name: bad-container
20+
resources: {}
21+
- image: ghcr.io/hackeramitkumar/test5:app
22+
name: good-container
23+
resources: {}

‎policy3.yml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
apiVersion: kyverno.io/v1
2+
kind: ClusterPolicy
3+
metadata:
4+
name: check-image
5+
spec:
6+
validationFailureAction: Enforce
7+
background: false
8+
webhookTimeoutSeconds: 30
9+
failurePolicy: Fail
10+
rules:
11+
- name: check-image
12+
match:
13+
any:
14+
- resources:
15+
kinds:
16+
- Pod
17+
verifyImages:
18+
- imageReferences:
19+
- "ghcr.io/hackeramitkumar*"
20+
attestors:
21+
- count: 1
22+
entries:
23+
- keys:
24+
publicKeys: |-
25+
-----BEGIN PUBLIC KEY-----
26+
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEFN8gGjQua2g8N+aLx3Eff+/j5HxL
27+
bV+H2z50/0A4d8XyMUvizPQBtcgei43pqLj1850m3wSwI08z2+6zT1QaEg==
28+
-----END PUBLIC KEY-----

‎policy4.yml

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
apiVersion: kyverno.io/v1
2+
kind: ClusterPolicy
3+
metadata:
4+
name: check-image-signature
5+
annotations:
6+
policies.kyverno.io/title: Check Image Signature
7+
policies.kyverno.io/category: ImageSignature
8+
policies.kyverno.io/severity: medium
9+
policies.kyverno.io/subject: Pod
10+
policies.kyverno.io/minversion: 1.7.0
11+
policies.kyverno.io/description: >-
12+
Using the Cosign project, OCI images may be signed to ensure supply chain
13+
security is maintained. Those signatures can be verified before pulling into
14+
a cluster. This policy checks the signature of an image repo called
15+
ghcr.io/kyverno/test-verify-image to ensure it has been signed by verifying
16+
its signature against the provided public key. This policy serves as an illustration for
17+
how to configure a similar rule and will require replacing with your image(s) and keys.
18+
spec:
19+
webhookTimeoutSeconds: 15
20+
validationFailureAction: audit
21+
background: false
22+
rules:
23+
- name: verify-image-signature
24+
match:
25+
resources: {}
26+
any:
27+
- resources:
28+
kinds:
29+
- Pod
30+
namespaces:
31+
- "cool-namespace"
32+
verifyImages:
33+
- imageReferences:
34+
- "*"
35+
mutateDigest: true
36+
required: true
37+
verifyDigest: true
38+
attestors:
39+
- entries:
40+
- keys:
41+
publicKeys: |
42+
-----BEGIN PUBLIC KEY-----
43+
...
44+
-----END PUBLIC KEY-----
45+
# BC: https://github.com/kyverno/kyverno/issues/5738
46+
mutate: {}
47+
validate: {}
48+
exclude:
49+
resources: {}
50+
generate:
51+
clone: {}
52+
cloneList: {}

‎values.yml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
policies:
2+
- name: check-image
3+
resources:
4+
# - name: pod-3
5+
- name: pod-4

0 commit comments

Comments
 (0)