kyverno.yaml

# #############################################################################
# Copyright (c) 2023 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made available under the
# terms of the Apache License, Version 2.0 which is available at
# https://www.apache.org/licenses/LICENSE-2.0.
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# SPDX-License-Identifier: Apache-2.0
# #############################################################################
---
name: Test Kyverno Policies

on:
  pull_request:
    branches:
      - main
    paths:
      - 'charts/**'
  workflow_dispatch:

env:
  VERSION: v1.10.1

jobs:
  list-changed:
    runs-on: ubuntu-latest
    outputs:
      changed: "${{ steps.list-changed.outputs.changed }}"
      charts: "${{ steps.list-changed.outputs.charts }}"
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Set up chart-testing
        uses: helm/chart-testing-action@v2.4.0

      - name: List changes
        id: list-changed
        run: |
          changed=$(ct list-changed --target-branch main)
          arr=(`echo $changed`)
          json=$(echo "${arr[@]}" | jq -ncR 'inputs | split(" ")')
          echo "charts=$json" >> $GITHUB_OUTPUT
          if [[ -n "$changed" ]]; then
            echo "changed=true" >> $GITHUB_OUTPUT
          fi

  kyverno-validate:
    runs-on: ubuntu-latest
    needs: [list-changed]
    if: ${{ needs.list-changed.outputs.changed == 'true' }}
    strategy:
      fail-fast: false
      matrix:
        chart:
          - ${{ fromJson(needs.list-changed.outputs.charts) }}
    steps:
      - name: Checkout repo
        uses: actions/checkout@v3

      - name: Install Helm
        uses: azure/setup-helm@v3

      - name: Download chart dependencies (recursive)
        shell: bash
        run: hack/helm-dependencies.bash

      - name: Create Helm template
        run: |
            helm template chart-template ${{ matrix.chart }}/ > ${{ matrix.chart }}/chart-template.yaml

      - name: Download Kyverno CLI
        run: |
          curl -sLO https://github.com/kyverno/kyverno/releases/download/${{ env.VERSION }}/kyverno-cli_${{ env.VERSION }}_linux_x86_64.tar.gz
          tar -xf kyverno-cli_${{ env.VERSION }}_linux_x86_64.tar.gz
          ${GITHUB_WORKSPACE}/kyverno version          

      - name: Test new resources against existing policies
        run: ${GITHUB_WORKSPACE}/kyverno apply .github/kyverno-policies/require-run-as-nonroot.yaml -r ${{ matrix.chart }}/chart-template.yaml