-
Notifications
You must be signed in to change notification settings - Fork 4
/
e2e.bats
142 lines (121 loc) · 6.83 KB
/
e2e.bats
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
#!/usr/bin/env bats
@test "RunAsAny should accept empty runAsUser, runAsGroup and supplementalGroups" {
run kwctl run --request-path test_data/e2e/empty_security_context_pod.json --settings-path test_data/e2e/settings_run_as_any.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":true.*') -ne 0 ]
}
@test "MustRunAs should reject invalid user ID" {
run kwctl run --request-path test_data/e2e/invalid_user_id.json --settings-path test_data/e2e/settings_must_run_as.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":false.*') -ne 0 ]
[ $(expr "$output" : '.*"message":"User ID outside defined ranges".*') -ne 0 ]
}
@test "MustRunAs should accept valid container user ID without mutating even if pod securityContext is invalid" {
run kwctl run --request-path test_data/e2e/pod_user_150.json --settings-path test_data/e2e/settings_must_run_as_100_200.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":true.*') -ne 0 ]
[ $(expr "$output" : '.*"patchType":"JSONPatch".*') -eq 0 ]
}
@test "MustRunAs should reject invalid group ID" {
run kwctl run --request-path test_data/e2e/invalid_group_id.json --settings-path test_data/e2e/settings_must_run_as.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":false.*') -ne 0 ]
[ $(expr "$output" : '.*"message":"Group ID is outside defined ranges".*') -ne 0 ]
}
@test "MustRunAs should reject invalid supplemental group ID" {
run kwctl run --request-path test_data/e2e/invalid_supplemental_group_.json --settings-path test_data/e2e/settings_must_run_as.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":false.*') -ne 0 ]
[ $(expr "$output" : '.*"message":"Group ID is outside defined ranges".*') -ne 0 ]
}
@test "MustRunAs should patch empty runAsUser, runAsGroup and supplementalGroups" {
run kwctl run --request-path test_data/e2e/empty_security_context_pod.json --settings-path test_data/e2e/settings_must_run_as.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":true.*') -ne 0 ]
[ $(expr "$output" : '.*"patchType":"JSONPatch".*') -ne 0 ]
}
@test "MayRunAs should accept empty runAsGroup and supplementalGroups" {
run kwctl run --request-path test_data/e2e/empty_security_context_pod.json --settings-path test_data/e2e/settings_may_run_as.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":true.*') -ne 0 ]
}
@test "MayRunAs should reject invalid group ID" {
run kwctl run --request-path test_data/e2e/invalid_group_id.json --settings-path test_data/e2e/settings_may_run_as.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":false.*') -ne 0 ]
[ $(expr "$output" : '.*"message":"Group ID is outside defined ranges".*') -ne 0 ]
}
@test "MayRunAs should reject invalid supplemental group ID" {
run kwctl run --request-path test_data/e2e/invalid_supplemental_group_.json --settings-path test_data/e2e/settings_may_run_as.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":false.*') -ne 0 ]
[ $(expr "$output" : '.*"message":"Group ID is outside defined ranges".*') -ne 0 ]
}
@test "MustRunAs should accept valid runAsUser, runAsGroup and supplementalGroups" {
run kwctl run --request-path test_data/e2e/valid_security_context.json --settings-path test_data/e2e/settings_must_run_as.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":true.*') -ne 0 ]
}
@test "MustRunAsNonRoot should reject 0 as user ID" {
run kwctl run --request-path test_data/e2e/zero_as_user_id.json --settings-path test_data/e2e/settings_must_run_as_non_root.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":false.*') -ne 0 ]
[ $(expr "$output" : '.*"message":"Invalid user ID: cannot run container with root ID (0)".*') -ne 0 ]
}
@test "MustRunAsNonRoot should mutate request when runAsUser is not defined" {
run kwctl run --request-path test_data/e2e/empty_security_context_pod.json --settings-path test_data/e2e/settings_must_run_as_non_root.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":true.*') -ne 0 ]
[ $(expr "$output" : '.*"patchType":"JSONPatch".*') -ne 0 ]
}
@test "MustRunAsNonRoot should accept request when user defined is not root" {
run kwctl run --request-path test_data/e2e/valid_security_context.json --settings-path test_data/e2e/settings_must_run_as_non_root.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":true.*') -ne 0 ]
}
@test "MustRunAs should patch runAsUser, runAsGroup and supplementalGroups when 'overwrite' is true" {
run kwctl run --request-path test_data/e2e/valid_security_context.json --settings-path test_data/e2e/settings_must_run_as_overwrite.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":true.*') -ne 0 ]
[ $(expr "$output" : '.*"patchType":"JSONPatch".*') -ne 0 ]
}
@test "MustRunAs should reject invalid container image user ID" {
run kwctl run --request-path test_data/e2e/invalid_container_image_user_id.json --settings-path test_data/e2e/settings_must_run_as_container_image_user_validation.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":false.*') -ne 0 ]
[ $(expr "$output" : '.*"message":"User ID defined in the container image is outside defined ranges".*') -ne 0 ]
}
@test "MustRunAs should reject invalid container image group ID" {
run kwctl run --request-path test_data/e2e/invalid_container_image_user_id.json --settings-path test_data/e2e/settings_must_run_as_container_image_group_validation.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":false.*') -ne 0 ]
[ $(expr "$output" : '.*"message":"Group ID defined in the container image is outside defined ranges".*') -ne 0 ]
}
@test "Settings should be invalid when container image user validation settings has an non-boolean value" {
run kwctl run --request-path test_data/e2e/invalid_container_image_user_id.json --settings-path test_data/e2e/settings_invalid_container_image_verification.json annotated-policy.wasm
[ "$status" -ne 0 ]
echo "$output"
[ $(expr "$output" : '.*invalid type: integer `1`, expected a boolean.*') -ne 0 ]
}
@test "RunAsAny should accept when container image group validation is enabled" {
run kwctl run --request-path test_data/e2e/invalid_container_image_user_id.json --settings-path test_data/e2e/settings_run_as_any_and_validate_container.json annotated-policy.wasm
[ "$status" -eq 0 ]
echo "$output"
[ $(expr "$output" : '.*"allowed":true.*') -ne 0 ]
}