# L0 policy-as-code suite for the CDI worker-pod label mutation — runs in CI WITHOUT a cluster
# (discovered recursively by the gate's `kyverno test platform/kyverno`; ci/l0.sh).
#
# WHY A SEPARATE SUITE from ../kyverno-test.yaml: a `kyverno test` manifest carries ONE
# `userinfo`, and the whole point here is that the SAME pods get different outcomes for
# different requesters. Two Test documents, two identities, one file:
#   1. cdi-controller-worker-pods-admitted  (requester = cdi/cdi-sa)     -> mutated, ADMITTED
#   2. cdi-worker-exemption-is-narrow       (requester = ordinary user)  -> not mutated, DENIED
# Keeping the mutate policy OUT of ../kyverno-test.yaml is deliberate: that suite declares no
# userinfo, and with no userinfo the offline engine does not discriminate on `subjects`, which
# would silently turn its negative (result: fail) rows into passes.
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
  name: cdi-controller-worker-pods-admitted
# Namespace labels for offline namespaceSelector resolution (shared with the main suite).
variables: ../values.yaml
userinfo: userinfo-cdi-sa.yaml
policies:
  - ../../policies/label-cdi-worker-pods.yaml
  - ../../policies/require-egress-class-label.yaml
  - ../../policies/require-auth-mode-label.yaml
resources:
  - ../resources/namespaces.yaml
  - resources/cdi-worker-pods.yaml
results:
  # ---- the mutation fires for the CDI controller and adds exactly the two labels ----
  - policy: label-cdi-worker-pods
    rule: add-worker-pod-labels
    kind: Pod
    resources:
      - importer-prime-be3f9d1c-c3ce-455a-a450-3d9e95c7baa2
    patchedResources: patched/importer-mutated.yaml
    result: pass
  # ---- R-NET-05 + R-IDP-02: the mutated CDI worker pod now SATISFIES both policies, so the
  #      import CDI could not start is admitted. (The engine validates the mutated resource.)
  - policy: require-egress-class-label
    rule: require-egress-class
    kind: Pod
    resources:
      - importer-prime-be3f9d1c-c3ce-455a-a450-3d9e95c7baa2
    result: pass
  - policy: require-auth-mode-label
    rule: require-auth-mode
    kind: Pod
    resources:
      - importer-prime-be3f9d1c-c3ce-455a-a450-3d9e95c7baa2
    result: pass
---
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
  name: cdi-worker-exemption-is-narrow
variables: ../values.yaml
userinfo: userinfo-ordinary.yaml
policies:
  - ../../policies/label-cdi-worker-pods.yaml
  - ../../policies/require-egress-class-label.yaml
  - ../../policies/require-auth-mode-label.yaml
resources:
  - ../resources/namespaces.yaml
  - resources/cdi-worker-pods.yaml
results:
  # ---- the mutation does NOT fire for an ordinary requester, not even for a pod that forges
  #      the importer's name and CDI's labels ----
  - policy: label-cdi-worker-pods
    rule: add-worker-pod-labels
    kind: Pod
    resources:
      - importer-prime-be3f9d1c-c3ce-455a-a450-3d9e95c7baa2
      - importer-prime-forged-by-an-app
      - plain-app-pod-no-labels
    result: skip
  # ---- so every unlabelled pod in the SAME app namespace is still DENIED (R-NET-05) ----
  - policy: require-egress-class-label
    rule: require-egress-class
    kind: Pod
    resources:
      - importer-prime-be3f9d1c-c3ce-455a-a450-3d9e95c7baa2
      - importer-prime-forged-by-an-app
      - plain-app-pod-no-labels
    result: fail
  # ---- ... and by R-IDP-02 ----
  - policy: require-auth-mode-label
    rule: require-auth-mode
    kind: Pod
    resources:
      - importer-prime-be3f9d1c-c3ce-455a-a450-3d9e95c7baa2
      - importer-prime-forged-by-an-app
      - plain-app-pod-no-labels
    result: fail