jakman85andClaude Opus 4.8
bb2e9fc931
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
113 lines
2.8 KiB
YAML
113 lines
2.8 KiB
YAML
# Pod fixtures for the label + host-namespace policies. Pods (not Deployments) are
|
|
# used so `kyverno test` result rows reference the base rule names directly; the
|
|
# same rules reach Deployment/StatefulSet pod templates via pod-controller autogen
|
|
# in CI and in-cluster.
|
|
#
|
|
# ---- COMPLIANT ----
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: good-workload
|
|
namespace: app-ns
|
|
labels:
|
|
homelab.keithjackson.dev/egress-class: internet
|
|
homelab.keithjackson.dev/auth-mode: oidc
|
|
spec:
|
|
containers:
|
|
- name: app
|
|
image: registry.example/app:1.0.0
|
|
---
|
|
# ---- egress-class violations (R-NET-05) ----
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: bad-egress-missing # no egress-class label at all
|
|
namespace: app-ns
|
|
labels:
|
|
homelab.keithjackson.dev/auth-mode: oidc
|
|
spec:
|
|
containers:
|
|
- name: app
|
|
image: registry.example/app:1.0.0
|
|
---
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: bad-egress-invalid # egress-class not in {internet,vpn}
|
|
namespace: app-ns
|
|
labels:
|
|
homelab.keithjackson.dev/egress-class: wan
|
|
homelab.keithjackson.dev/auth-mode: oidc
|
|
spec:
|
|
containers:
|
|
- name: app
|
|
image: registry.example/app:1.0.0
|
|
---
|
|
# ---- auth-mode violations (R-IDP-02) ----
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: bad-auth-missing # no auth-mode label
|
|
namespace: app-ns
|
|
labels:
|
|
homelab.keithjackson.dev/egress-class: vpn
|
|
spec:
|
|
containers:
|
|
- name: app
|
|
image: registry.example/app:1.0.0
|
|
---
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: bad-auth-invalid # auth-mode not in the enum
|
|
namespace: app-ns
|
|
labels:
|
|
homelab.keithjackson.dev/egress-class: vpn
|
|
homelab.keithjackson.dev/auth-mode: basic
|
|
spec:
|
|
containers:
|
|
- name: app
|
|
image: registry.example/app:1.0.0
|
|
---
|
|
# ---- host-namespace / privilege violations (R-SEC-02) ----
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: bad-hostnetwork # hostNetwork bypasses default-deny
|
|
namespace: app-ns
|
|
labels:
|
|
homelab.keithjackson.dev/egress-class: internet
|
|
homelab.keithjackson.dev/auth-mode: none
|
|
spec:
|
|
hostNetwork: true
|
|
containers:
|
|
- name: app
|
|
image: registry.example/app:1.0.0
|
|
---
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: bad-privileged # privileged container
|
|
namespace: app-ns
|
|
labels:
|
|
homelab.keithjackson.dev/egress-class: internet
|
|
homelab.keithjackson.dev/auth-mode: none
|
|
spec:
|
|
containers:
|
|
- name: app
|
|
image: registry.example/app:1.0.0
|
|
securityContext:
|
|
privileged: true
|
|
---
|
|
# ---- scope proof: same bare pod in a NON-app namespace must be SKIPPED ----
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: platform-workload
|
|
namespace: platform-ns
|
|
spec:
|
|
hostNetwork: true # allowed here: platform ns is out of scope
|
|
containers:
|
|
- name: agent
|
|
image: registry.example/agent:1.0.0
|