# R-SEC-02 — the PM agent dispatcher cannot escalate to arbitrary privileged execution.
#
# The dispatcher's one privileged act is `create jobs` in its own namespace, and Kubernetes
# places no `use` check on serviceAccountName — so without
# platform/kyverno/admission/pm-agent-job-shape.yaml that single verb IS arbitrary code
# execution in the namespace, holding a Gitea write token and an Anthropic subscription
# token. These rows are what prove the policy actually refuses each route to it.
#
# user-info.yaml supplies the requesting identity. WITHOUT it the policy's `subjects` match
# never fires, every case trivially passes, and this file becomes coverage theatre.
#
# A NOTE ON WHICH ROWS NAME WHICH FIXTURES: a `foreach` over an absent list produces no
# result at all, so a fixture with no `volumes` (or no `env`) is NOT reported by the rule
# that iterates them and must not be listed for it. That is why the volume and env rows name
# fixtures individually instead of listing everything.
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
  name: pm-agent-job-shape
policies:
  - ../../admission/pm-agent-job-shape.yaml
resources:
  - resources.yaml
userinfo: user-info.yaml
results:
  # ---------------- the committed run is ADMITTED ----------------
  - policy: pm-agent-job-shape
    rule: worker-must-be-the-committed-shape
    kind: Job
    resources: [good-run, real-template]
    result: pass
  - policy: pm-agent-job-shape
    rule: worker-must-be-one-container-with-no-args
    kind: Job
    resources: [good-run, real-template]
    result: pass
  - policy: pm-agent-job-shape
    rule: worker-volumes-must-be-workspace-or-tmp-emptydirs
    kind: Job
    resources: [good-run, real-template]
    result: pass
  - policy: pm-agent-job-shape
    rule: worker-may-not-declare-init-or-ephemeral-containers
    kind: Job
    resources: [good-run, real-template]
    result: pass
  # Only `real-template` and `injected-env` set env at all, so they are the only fixtures the
  # env rule reports on.
  - policy: pm-agent-job-shape
    rule: worker-env-names-must-be-the-committed-set
    kind: Job
    resources: [real-template]
    result: pass
  - policy: pm-agent-job-shape
    rule: worker-may-not-use-envfrom
    kind: Job
    resources: [good-run, real-template]
    result: pass
  - policy: pm-agent-job-shape
    rule: worker-pull-secret-must-be-the-committed-one
    kind: Job
    resources: [good-run, real-template]
    result: pass

  # ---------------- THE escalation, and the shape rule's other refusals ----------------
  # `evil-command` is the case the whole model exists for: right namespace, right creator,
  # arbitrary command. The rest are each a single field away from compliant.
  - policy: pm-agent-job-shape
    rule: worker-must-be-the-committed-shape
    kind: Job
    resources:
      - evil-command
      - evil-image
      - tag-not-digest
      - worker-as-dispatcher-sa
      - token-mounted
      - writable-rootfs
      - host-namespaces
      - restart-onfailure
      - second-container
      - no-pull-secret
    result: fail

  # ---------------- the pull secret: a second one, or a different one ----------------
  - policy: pm-agent-job-shape
    rule: worker-pull-secret-must-be-the-committed-one
    kind: Job
    resources: [extra-pull-secret, wrong-pull-secret]
    result: fail

  # ---------------- args, and the second container ----------------
  - policy: pm-agent-job-shape
    rule: worker-must-be-one-container-with-no-args
    kind: Job
    resources: [injected-args, second-container]
    result: fail

  # ---------------- an extra volume, or an allowed name over a hostPath ----------------
  - policy: pm-agent-job-shape
    rule: worker-volumes-must-be-workspace-or-tmp-emptydirs
    kind: Job
    resources: [extra-volume, hostpath-named-workspace]
    result: fail

  # ---------------- the same escalation via the other two container lists ----------------
  - policy: pm-agent-job-shape
    rule: worker-may-not-declare-init-or-ephemeral-containers
    kind: Job
    resources: [evil-initcontainer, evil-ephemeral-container]
    result: fail

  # ---------------- and via env, and via envFrom ----------------
  - policy: pm-agent-job-shape
    rule: worker-env-names-must-be-the-committed-set
    kind: Job
    resources: [injected-env]
    result: fail
  - policy: pm-agent-job-shape
    rule: worker-may-not-use-envfrom
    kind: Job
    resources: [envfrom-whole-secret]
    result: fail