diff --git a/library/general/allowedrepos/suite.yaml b/library/general/allowedrepos/suite.yaml index b5b80cbf6..3367d88e8 100644 --- a/library/general/allowedrepos/suite.yaml +++ b/library/general/allowedrepos/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: allowedrepos tests: - name: allowed-repos template: template.yaml diff --git a/library/general/block-endpoint-edit-default-role/suite.yaml b/library/general/block-endpoint-edit-default-role/suite.yaml index 8446659d7..632c48ee7 100644 --- a/library/general/block-endpoint-edit-default-role/suite.yaml +++ b/library/general/block-endpoint-edit-default-role/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: block-endpoint-edit-default-role tests: - name: block-endpoint-default-role template: template.yaml diff --git a/library/general/block-nodeport-services/suite.yaml b/library/general/block-nodeport-services/suite.yaml index f5158ec51..056ffaf84 100644 --- a/library/general/block-nodeport-services/suite.yaml +++ b/library/general/block-nodeport-services/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: block-nodeport-services tests: - name: block-nodeport-services template: template.yaml diff --git a/library/general/containerlimits/suite.yaml b/library/general/containerlimits/suite.yaml index 4b1caf704..c22bd5b77 100644 --- a/library/general/containerlimits/suite.yaml +++ b/library/general/containerlimits/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: containerlimits tests: - name: container-limits template: template.yaml diff --git a/library/general/containerresourceratios/suite.yaml b/library/general/containerresourceratios/suite.yaml index 355144bc9..240993cbd 100644 --- a/library/general/containerresourceratios/suite.yaml +++ b/library/general/containerresourceratios/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: containerresourceratios tests: - name: block-endpoint-default-role template: template.yaml diff --git a/library/general/disallowedtags/suite.yaml b/library/general/disallowedtags/suite.yaml index 5637c59aa..8d0574a10 100644 --- a/library/general/disallowedtags/suite.yaml +++ b/library/general/disallowedtags/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: disallowedtags tests: - name: block-endpoint-default-role template: template.yaml diff --git a/library/general/externalip/suite.yaml b/library/general/externalip/suite.yaml index 6af203fc8..1015dc4ca 100644 --- a/library/general/externalip/suite.yaml +++ b/library/general/externalip/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: externalip tests: - name: block-endpoint-default-role template: template.yaml diff --git a/library/general/httpsonly/suite.yaml b/library/general/httpsonly/suite.yaml index b74f28173..4daeb311b 100644 --- a/library/general/httpsonly/suite.yaml +++ b/library/general/httpsonly/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: httpsonly tests: - name: block-endpoint-default-role template: template.yaml diff --git a/library/general/imagedigests/suite.yaml b/library/general/imagedigests/suite.yaml index 8d3bd68e3..319f477f4 100644 --- a/library/general/imagedigests/suite.yaml +++ b/library/general/imagedigests/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: imagedigests tests: - name: block-endpoint-default-role template: template.yaml diff --git a/library/general/replicalimits/suite.yaml b/library/general/replicalimits/suite.yaml index 5828c761a..71dc62723 100644 --- a/library/general/replicalimits/suite.yaml +++ b/library/general/replicalimits/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: replicalimits tests: - name: block-endpoint-default-role template: template.yaml diff --git a/library/general/requiredannotations/suite.yaml b/library/general/requiredannotations/suite.yaml index 1108808d7..96f90d420 100644 --- a/library/general/requiredannotations/suite.yaml +++ b/library/general/requiredannotations/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: requiredannotations tests: - name: block-endpoint-default-role template: template.yaml diff --git a/library/general/requiredlabels/suite.yaml b/library/general/requiredlabels/suite.yaml index f3893befd..a169756b6 100644 --- a/library/general/requiredlabels/suite.yaml +++ b/library/general/requiredlabels/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: requiredlabels tests: - name: block-endpoint-default-role template: template.yaml diff --git a/library/general/requiredprobes/suite.yaml b/library/general/requiredprobes/suite.yaml index f7f497709..379e77563 100644 --- a/library/general/requiredprobes/suite.yaml +++ b/library/general/requiredprobes/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: requiredprobes tests: - name: block-endpoint-default-role template: template.yaml diff --git a/library/general/uniqueingresshost/suite.yaml b/library/general/uniqueingresshost/suite.yaml index aa2833cbe..ab25170d2 100644 --- a/library/general/uniqueingresshost/suite.yaml +++ b/library/general/uniqueingresshost/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: uniqueingresshost tests: - name: block-endpoint-default-role template: template.yaml diff --git a/library/general/uniqueserviceselector/suite.yaml b/library/general/uniqueserviceselector/suite.yaml index 817e07c25..a72ffb9b4 100644 --- a/library/general/uniqueserviceselector/suite.yaml +++ b/library/general/uniqueserviceselector/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: uniqueserviceselector tests: - name: block-endpoint-default-role template: template.yaml diff --git a/library/pod-security-policy/allow-privilege-escalation/suite.yaml b/library/pod-security-policy/allow-privilege-escalation/suite.yaml index 3f3a7e4fe..28012235d 100644 --- a/library/pod-security-policy/allow-privilege-escalation/suite.yaml +++ b/library/pod-security-policy/allow-privilege-escalation/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: allow-privilege-escalation tests: - name: allow-privilege-escalation template: template.yaml diff --git a/library/pod-security-policy/apparmor/suite.yaml b/library/pod-security-policy/apparmor/suite.yaml index 49439da54..9addb98f0 100644 --- a/library/pod-security-policy/apparmor/suite.yaml +++ b/library/pod-security-policy/apparmor/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: apparmor tests: - name: apparmor template: template.yaml diff --git a/library/pod-security-policy/capabilities/suite.yaml b/library/pod-security-policy/capabilities/suite.yaml index 7ab86cf41..6909ec433 100644 --- a/library/pod-security-policy/capabilities/suite.yaml +++ b/library/pod-security-policy/capabilities/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: capabilities tests: - name: capabilities template: template.yaml diff --git a/library/pod-security-policy/flexvolume-drivers/suite.yaml b/library/pod-security-policy/flexvolume-drivers/suite.yaml index c52e1b76c..1f4a4ef75 100644 --- a/library/pod-security-policy/flexvolume-drivers/suite.yaml +++ b/library/pod-security-policy/flexvolume-drivers/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: flexvolume-drivers tests: - name: flexvolume-drivers template: template.yaml diff --git a/library/pod-security-policy/forbidden-sysctls/suite.yaml b/library/pod-security-policy/forbidden-sysctls/suite.yaml index 05ecc5410..bcc4caaae 100644 --- a/library/pod-security-policy/forbidden-sysctls/suite.yaml +++ b/library/pod-security-policy/forbidden-sysctls/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: forbidden-sysctls tests: - name: forbidden-sysctls template: template.yaml diff --git a/library/pod-security-policy/fsgroup/suite.yaml b/library/pod-security-policy/fsgroup/suite.yaml index d01d51e35..f24cb6a35 100644 --- a/library/pod-security-policy/fsgroup/suite.yaml +++ b/library/pod-security-policy/fsgroup/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: fsgroup tests: - name: fsgroup template: template.yaml diff --git a/library/pod-security-policy/host-filesystem/suite.yaml b/library/pod-security-policy/host-filesystem/suite.yaml index 78bb3ea8b..f97357467 100644 --- a/library/pod-security-policy/host-filesystem/suite.yaml +++ b/library/pod-security-policy/host-filesystem/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: host-filesystem tests: - name: host-filesystem template: template.yaml diff --git a/library/pod-security-policy/host-namespaces/suite.yaml b/library/pod-security-policy/host-namespaces/suite.yaml index c3f84b095..d274351ff 100644 --- a/library/pod-security-policy/host-namespaces/suite.yaml +++ b/library/pod-security-policy/host-namespaces/suite.yaml @@ -1,5 +1,7 @@ kind: Suite apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: host-namespaces tests: - name: host-namespace template: template.yaml diff --git a/library/pod-security-policy/host-network-ports/suite.yaml b/library/pod-security-policy/host-network-ports/suite.yaml new file mode 100644 index 000000000..cdbe68315 --- /dev/null +++ b/library/pod-security-policy/host-network-ports/suite.yaml @@ -0,0 +1,17 @@ +kind: Suite +apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: host-network-ports +tests: +- name: use-of-host-networking-ports-blocked + template: template.yaml + constraint: samples/psp-host-network-ports/constraint.yaml + cases: + - name: example-disallowed + object: samples/psp-host-network-ports/example_disallowed.yaml + assertions: + - violations: yes + - name: example-allowed + object: samples/psp-host-network-ports/example_allowed.yaml + assertions: + - violations: no diff --git a/library/pod-security-policy/privileged-containers/suite.yaml b/library/pod-security-policy/privileged-containers/suite.yaml new file mode 100644 index 000000000..ad3784ef4 --- /dev/null +++ b/library/pod-security-policy/privileged-containers/suite.yaml @@ -0,0 +1,17 @@ +kind: Suite +apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: privileged-containers +tests: +- name: privileged-containers-disallowed + template: template.yaml + constraint: samples/psp-privileged-container/constraint.yaml + cases: + - name: example-disallowed + object: samples/psp-privileged-container/example_disallowed.yaml + assertions: + - violations: yes + - name: example-allowed + object: samples/psp-privileged-container/example_allowed.yaml + assertions: + - violations: no diff --git a/library/pod-security-policy/proc-mount/samples/psp-proc-mount/example_allowed.yaml b/library/pod-security-policy/proc-mount/samples/psp-proc-mount/example_allowed.yaml new file mode 100644 index 000000000..c9b13ac71 --- /dev/null +++ b/library/pod-security-policy/proc-mount/samples/psp-proc-mount/example_allowed.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx-proc-mount-disallowed + labels: + app: nginx-proc-mount +spec: + containers: + - name: nginx + image: nginx + securityContext: + procMount: Default diff --git a/library/pod-security-policy/proc-mount/suite.yaml b/library/pod-security-policy/proc-mount/suite.yaml new file mode 100644 index 000000000..12e40462b --- /dev/null +++ b/library/pod-security-policy/proc-mount/suite.yaml @@ -0,0 +1,17 @@ +kind: Suite +apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: proc-mount +tests: +- name: default-proc-mount-required + template: template.yaml + constraint: samples/psp-proc-mount/constraint.yaml + cases: + - name: example-disallowed + object: samples/psp-proc-mount/example_disallowed.yaml + assertions: + - violations: yes + - name: example-allowed + object: samples/psp-proc-mount/example_allowed.yaml + assertions: + - violations: no diff --git a/library/pod-security-policy/read-only-root-filesystem/suite.yaml b/library/pod-security-policy/read-only-root-filesystem/suite.yaml new file mode 100644 index 000000000..467913b09 --- /dev/null +++ b/library/pod-security-policy/read-only-root-filesystem/suite.yaml @@ -0,0 +1,17 @@ +kind: Suite +apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: read-only-root-filesystem +tests: +- name: + template: template.yaml + constraint: samples/psp-readonlyrootfilesystem/constraint.yaml + cases: + - name: example-disallowed + object: samples/psp-readonlyrootfilesystem/example_disallowed.yaml + assertions: + - violations: yes + - name: example-allowed + object: samples/psp-readonlyrootfilesystem/example_allowed.yaml + assertions: + - violations: no diff --git a/library/pod-security-policy/seccomp/suite.yaml b/library/pod-security-policy/seccomp/suite.yaml new file mode 100644 index 000000000..f24e5adb2 --- /dev/null +++ b/library/pod-security-policy/seccomp/suite.yaml @@ -0,0 +1,27 @@ +kind: Suite +apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: seccomp +tests: +- name: default-seccomp-required + template: template.yaml + constraint: samples/psp-seccomp/constraint.yaml + cases: + - name: example-disallowed-global + object: samples/psp-seccomp/example_disallowed.yaml + assertions: + - violations: 1 + message: "Seccomp profile is not allowed" + - name: example-disallowed-container + object: samples/psp-seccomp/example_disallowed.yaml + assertions: + - violations: 1 + message: "Seccomp profile is not allowed" + - name: example-allowed-container + object: samples/psp-seccomp/example_allowed.yaml + assertions: + - violations: no + - name: example-allowed-global + object: samples/psp-seccomp/example_allowed2.yaml + assertions: + - violations: no diff --git a/library/pod-security-policy/selinux/samples/psp-selinux-v2/example_allowed.yaml b/library/pod-security-policy/selinux/samples/psp-selinux-v2/example_allowed.yaml new file mode 100644 index 000000000..4eaf2dc92 --- /dev/null +++ b/library/pod-security-policy/selinux/samples/psp-selinux-v2/example_allowed.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx-selinux-allowed + labels: + app: nginx-selinux +spec: + containers: + - name: nginx + image: nginx + securityContext: + seLinuxOptions: + level: s0:c123,c456 + role: object_r + type: svirt_sandbox_file_t + user: system_u diff --git a/library/pod-security-policy/selinux/suite.yaml b/library/pod-security-policy/selinux/suite.yaml new file mode 100644 index 000000000..57ca55e1f --- /dev/null +++ b/library/pod-security-policy/selinux/suite.yaml @@ -0,0 +1,17 @@ +kind: Suite +apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: selinux +tests: +- name: require-matching-selinux-options + template: template.yaml + constraint: samples/psp-selinux-v2/constraint.yaml + cases: + - name: example-disallowed + object: samples/psp-selinux-v2/example_disallowed.yaml + assertions: + - violations: yes + - name: example-allowed + object: samples/psp-selinux-v2/example_allowed.yaml + assertions: + - violations: no diff --git a/library/pod-security-policy/users/samples/psp-pods-allowed-user-ranges/example_allowed.yaml b/library/pod-security-policy/users/samples/psp-pods-allowed-user-ranges/example_allowed.yaml new file mode 100644 index 000000000..79899ed98 --- /dev/null +++ b/library/pod-security-policy/users/samples/psp-pods-allowed-user-ranges/example_allowed.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx-users-allowed + labels: + app: nginx-users +spec: + securityContext: + supplementalGroups: + - 199 + fsGroup: 199 + containers: + - name: nginx + image: nginx + securityContext: + runAsUser: 199 + runAsGroup: 199 diff --git a/library/pod-security-policy/users/suite.yaml b/library/pod-security-policy/users/suite.yaml new file mode 100644 index 000000000..fbf869880 --- /dev/null +++ b/library/pod-security-policy/users/suite.yaml @@ -0,0 +1,17 @@ +kind: Suite +apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: users +tests: +- name: users-and-groups-together + template: template.yaml + constraint: samples/psp-pods-allowed-user-ranges/constraint.yaml + cases: + - name: example-disallowed + object: samples/psp-pods-allowed-user-ranges/example_disallowed.yaml + assertions: + - violations: yes + - name: example-allowed + object: samples/psp-pods-allowed-user-ranges/example_allowed.yaml + assertions: + - violations: no diff --git a/library/pod-security-policy/volumes/samples/psp-volume-types/example_allowed.yaml b/library/pod-security-policy/volumes/samples/psp-volume-types/example_allowed.yaml new file mode 100644 index 000000000..df6251e7d --- /dev/null +++ b/library/pod-security-policy/volumes/samples/psp-volume-types/example_allowed.yaml @@ -0,0 +1,23 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx-volume-types-allowed + labels: + app: nginx-volume-types +spec: + containers: + - name: nginx + image: nginx + volumeMounts: + - mountPath: /cache + name: cache-volume + - name: nginx2 + image: nginx + volumeMounts: + - mountPath: /cache2 + name: demo-vol + volumes: + - name: cache-volume + emptyDir: {} + - name: demo-vol + emptyDir: {} diff --git a/library/pod-security-policy/volumes/suite.yaml b/library/pod-security-policy/volumes/suite.yaml new file mode 100644 index 000000000..b8f91b5a4 --- /dev/null +++ b/library/pod-security-policy/volumes/suite.yaml @@ -0,0 +1,17 @@ +kind: Suite +apiVersion: test.gatekeeper.sh/v1alpha1 +metadata: + name: volumes +tests: +- name: host-path-disallowed + template: template.yaml + constraint: samples/psp-volume-types/constraint.yaml + cases: + - name: example-disallowed + object: samples/psp-volume-types/example_disallowed.yaml + assertions: + - violations: yes + - name: example-allowed + object: samples/psp-volume-types/example_allowed.yaml + assertions: + - violations: no