jakman85andClaude Opus 4.8
08113ccfbb
The offline `kyverno test` CLI cannot resolve the Flux postBuild token
${KYVERNO_VALIDATION_ACTION} in validationFailureAction, so the 4 policies
carrying it failed to load and their result rows reported "Not found" (14/17
cases). Render a throwaway copy of platform/kyverno with the base/prod value
(Enforce) before `kyverno test` in both ci/l0.sh and scripts/run-l0.sh; this
does not change in-cluster enforcement.
Add tests/values.yaml supplying Namespace labels so the offline CLI resolves
namespaceSelector matches -- without it the R-SEC-02/R-NET-05/R-IDP-02 Pod
cases were silently EXCLUDED (vacuous), not evaluated.
Pin kyverno-json 0.0.3 in ci/versions.env (0.0.5 has no upstream release;
0.0.3 is what run-l0.sh and the devcontainer already use).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
129 lines
3.7 KiB
YAML
129 lines
3.7 KiB
YAML
# L0 policy-as-code test suite -- runs in CI WITHOUT a cluster.
|
|
# Run from this directory: kyverno test .
|
|
# Each result row is tagged (in comments) with the requirement ID it proves.
|
|
# Deterministic, hermetic, reproducible (docs/14 reproducibility contract).
|
|
apiVersion: cli.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: platform-kyverno-l0
|
|
# Namespace labels for namespaceSelector resolution offline (see values.yaml).
|
|
variables: values.yaml
|
|
policies:
|
|
- ../policies/require-default-deny-baseline.yaml
|
|
- ../policies/validate-default-deny-shape.yaml
|
|
- ../policies/disallow-plaintext-secrets.yaml
|
|
- ../policies/restrict-host-namespaces.yaml
|
|
- ../policies/require-egress-class-label.yaml
|
|
- ../policies/require-auth-mode-label.yaml
|
|
resources:
|
|
- resources/namespaces.yaml
|
|
- resources/workloads.yaml
|
|
- resources/secrets.yaml
|
|
- resources/networkpolicies.yaml
|
|
results:
|
|
# ---- R-NET-01: default-deny baseline is GENERATED for an app namespace ----
|
|
- policy: require-default-deny-baseline
|
|
rule: generate-default-deny
|
|
kind: Namespace
|
|
resources:
|
|
- app-ns
|
|
generatedResource: resources/generated-default-deny.yaml
|
|
result: pass
|
|
|
|
# ---- R-NET-01: a malformed baseline (egress left open) is rejected ----
|
|
- policy: validate-default-deny-shape
|
|
rule: baseline-must-deny-both-directions
|
|
kind: NetworkPolicy
|
|
resources:
|
|
- good-baseline-np
|
|
result: pass
|
|
- policy: validate-default-deny-shape
|
|
rule: baseline-must-deny-both-directions
|
|
kind: NetworkPolicy
|
|
resources:
|
|
- bad-baseline-np
|
|
result: fail
|
|
|
|
# ---- R-SEC-01: plaintext Secret rejected; SOPS-encrypted Secret admitted ----
|
|
- policy: disallow-plaintext-secrets
|
|
rule: secrets-must-be-sops-encrypted
|
|
kind: Secret
|
|
resources:
|
|
- good-secret-sops
|
|
result: pass
|
|
- policy: disallow-plaintext-secrets
|
|
rule: secrets-must-be-sops-encrypted
|
|
kind: Secret
|
|
resources:
|
|
- bad-secret-plain
|
|
result: fail
|
|
|
|
# ---- R-SEC-02: hostNetwork/hostPID/hostIPC rejected in app namespaces ----
|
|
- policy: restrict-host-namespaces
|
|
rule: disallow-host-namespaces
|
|
kind: Pod
|
|
resources:
|
|
- good-workload
|
|
result: pass
|
|
- policy: restrict-host-namespaces
|
|
rule: disallow-host-namespaces
|
|
kind: Pod
|
|
resources:
|
|
- bad-hostnetwork
|
|
result: fail
|
|
- policy: restrict-host-namespaces
|
|
rule: disallow-host-namespaces
|
|
kind: Pod
|
|
resources:
|
|
- platform-workload # non-app namespace -> out of scope
|
|
result: skip
|
|
# ---- R-SEC-02: privileged container rejected ----
|
|
- policy: restrict-host-namespaces
|
|
rule: disallow-privileged-containers
|
|
kind: Pod
|
|
resources:
|
|
- good-workload
|
|
result: pass
|
|
- policy: restrict-host-namespaces
|
|
rule: disallow-privileged-containers
|
|
kind: Pod
|
|
resources:
|
|
- bad-privileged
|
|
result: fail
|
|
|
|
# ---- R-NET-05: egress-class label required and enum-checked ----
|
|
- policy: require-egress-class-label
|
|
rule: require-egress-class
|
|
kind: Pod
|
|
resources:
|
|
- good-workload
|
|
result: pass
|
|
- policy: require-egress-class-label
|
|
rule: require-egress-class
|
|
kind: Pod
|
|
resources:
|
|
- bad-egress-missing
|
|
- bad-egress-invalid
|
|
result: fail
|
|
- policy: require-egress-class-label
|
|
rule: require-egress-class
|
|
kind: Pod
|
|
resources:
|
|
- platform-workload # non-app namespace -> out of scope
|
|
result: skip
|
|
|
|
# ---- R-IDP-02: auth-mode label required and enum-checked ----
|
|
- policy: require-auth-mode-label
|
|
rule: require-auth-mode
|
|
kind: Pod
|
|
resources:
|
|
- good-workload
|
|
result: pass
|
|
- policy: require-auth-mode-label
|
|
rule: require-auth-mode
|
|
kind: Pod
|
|
resources:
|
|
- bad-auth-missing
|
|
- bad-auth-invalid
|
|
result: fail
|