generated from kubewarden/go-policy-template
-
Notifications
You must be signed in to change notification settings - Fork 3
/
e2e.bats
49 lines (40 loc) · 1.52 KB
/
e2e.bats
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
#!/usr/bin/env bats
@test "reject because /data is not in settings" {
run kwctl run annotated-policy.wasm -r test_data/request-pod-hostpaths.json \
--settings-json \
'{ "allowedHostPaths": [
{"pathPrefix": "/var","readOnly": false},
{"pathPrefix": "/var/local/aaa","readOnly": false}
]
}'
# this prints the output when one the checks below fails
echo "output = ${output}"
# request rejected
[ "$status" -eq 0 ]
[ $(expr "$output" : '.*allowed.*false') -ne 0 ]
[ $(expr "$output" : ".*hostPath '/data' mounted as 'test-data' is not in the AllowedHostPaths list.*") -ne 0 ]
}
@test "accept because pod has no hostPath volumes" {
run kwctl run annotated-policy.wasm -r test_data/request-pod-no-hostpaths.json \
--settings-json \
'{ "allowedHostPaths": [ {"pathPrefix": "/foo","readOnly": true} ] }'
# this prints the output when one the checks below fails
echo "output = ${output}"
# request accepted
[ "$status" -eq 0 ]
[ $(expr "$output" : '.*allowed.*true') -ne 0 ]
}
@test "accept because /var/local has precedence over /var" {
run kwctl run annotated-policy.wasm -r test_data/request-pod-precedence.json \
--settings-json \
'{ "allowedHostPaths": [
{"pathPrefix": "/var","readOnly": false},
{"pathPrefix": "/var/local","readOnly": true}
]
}'
# this prints the output when one the checks below fails
echo "output = ${output}"
# request accepted
[ "$status" -eq 0 ]
[ $(expr "$output" : '.*allowed.*true') -ne 0 ]
}