jakman85andClaude Opus 4.8
bb2e9fc931
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
127 lines
3.6 KiB
YAML
127 lines
3.6 KiB
YAML
# L0 policy-as-code test suite -- runs in CI WITHOUT a cluster.
|
|
# Run from this directory: kyverno test .
|
|
# Each result row is tagged (in comments) with the requirement ID it proves.
|
|
# Deterministic, hermetic, reproducible (docs/14 reproducibility contract).
|
|
apiVersion: cli.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: platform-kyverno-l0
|
|
policies:
|
|
- ../policies/require-default-deny-baseline.yaml
|
|
- ../policies/validate-default-deny-shape.yaml
|
|
- ../policies/disallow-plaintext-secrets.yaml
|
|
- ../policies/restrict-host-namespaces.yaml
|
|
- ../policies/require-egress-class-label.yaml
|
|
- ../policies/require-auth-mode-label.yaml
|
|
resources:
|
|
- resources/namespaces.yaml
|
|
- resources/workloads.yaml
|
|
- resources/secrets.yaml
|
|
- resources/networkpolicies.yaml
|
|
results:
|
|
# ---- R-NET-01: default-deny baseline is GENERATED for an app namespace ----
|
|
- policy: require-default-deny-baseline
|
|
rule: generate-default-deny
|
|
kind: Namespace
|
|
resources:
|
|
- app-ns
|
|
generatedResource: resources/generated-default-deny.yaml
|
|
result: pass
|
|
|
|
# ---- R-NET-01: a malformed baseline (egress left open) is rejected ----
|
|
- policy: validate-default-deny-shape
|
|
rule: baseline-must-deny-both-directions
|
|
kind: NetworkPolicy
|
|
resources:
|
|
- good-baseline-np
|
|
result: pass
|
|
- policy: validate-default-deny-shape
|
|
rule: baseline-must-deny-both-directions
|
|
kind: NetworkPolicy
|
|
resources:
|
|
- bad-baseline-np
|
|
result: fail
|
|
|
|
# ---- R-SEC-01: plaintext Secret rejected; SOPS-encrypted Secret admitted ----
|
|
- policy: disallow-plaintext-secrets
|
|
rule: secrets-must-be-sops-encrypted
|
|
kind: Secret
|
|
resources:
|
|
- good-secret-sops
|
|
result: pass
|
|
- policy: disallow-plaintext-secrets
|
|
rule: secrets-must-be-sops-encrypted
|
|
kind: Secret
|
|
resources:
|
|
- bad-secret-plain
|
|
result: fail
|
|
|
|
# ---- R-SEC-02: hostNetwork/hostPID/hostIPC rejected in app namespaces ----
|
|
- policy: restrict-host-namespaces
|
|
rule: disallow-host-namespaces
|
|
kind: Pod
|
|
resources:
|
|
- good-workload
|
|
result: pass
|
|
- policy: restrict-host-namespaces
|
|
rule: disallow-host-namespaces
|
|
kind: Pod
|
|
resources:
|
|
- bad-hostnetwork
|
|
result: fail
|
|
- policy: restrict-host-namespaces
|
|
rule: disallow-host-namespaces
|
|
kind: Pod
|
|
resources:
|
|
- platform-workload # non-app namespace -> out of scope
|
|
result: skip
|
|
# ---- R-SEC-02: privileged container rejected ----
|
|
- policy: restrict-host-namespaces
|
|
rule: disallow-privileged-containers
|
|
kind: Pod
|
|
resources:
|
|
- good-workload
|
|
result: pass
|
|
- policy: restrict-host-namespaces
|
|
rule: disallow-privileged-containers
|
|
kind: Pod
|
|
resources:
|
|
- bad-privileged
|
|
result: fail
|
|
|
|
# ---- R-NET-05: egress-class label required and enum-checked ----
|
|
- policy: require-egress-class-label
|
|
rule: require-egress-class
|
|
kind: Pod
|
|
resources:
|
|
- good-workload
|
|
result: pass
|
|
- policy: require-egress-class-label
|
|
rule: require-egress-class
|
|
kind: Pod
|
|
resources:
|
|
- bad-egress-missing
|
|
- bad-egress-invalid
|
|
result: fail
|
|
- policy: require-egress-class-label
|
|
rule: require-egress-class
|
|
kind: Pod
|
|
resources:
|
|
- platform-workload # non-app namespace -> out of scope
|
|
result: skip
|
|
|
|
# ---- R-IDP-02: auth-mode label required and enum-checked ----
|
|
- policy: require-auth-mode-label
|
|
rule: require-auth-mode
|
|
kind: Pod
|
|
resources:
|
|
- good-workload
|
|
result: pass
|
|
- policy: require-auth-mode-label
|
|
rule: require-auth-mode
|
|
kind: Pod
|
|
resources:
|
|
- bad-auth-missing
|
|
- bad-auth-invalid
|
|
result: fail
|