feat: add other policies in CEL expressions - Part 4 (#964)

* add CI test for other-cel re(c-q) directories Signed-off-by: Chandan-DK <[email protected]> * copy require-annotations Signed-off-by: Chandan-DK <[email protected]> * add kyverno tests for require-annotations Signed-off-by: Chandan-DK <[email protected]> * convert require-annotations to cel Signed-off-by: Chandan-DK <[email protected]> * copy require-deployments-have-multiple-replicas Signed-off-by: Chandan-DK <[email protected]> * add fail kyverno tests for require-deployments-have-multiple-replica Signed-off-by: Chandan-DK <[email protected]> * convert require-deployments-have-multiple-replicas to cel Signed-off-by: Chandan-DK <[email protected]> * copy require-image-checksum Signed-off-by: Chandan-DK <[email protected]> * convert require-image-checksum to cel Signed-off-by: Chandan-DK <[email protected]> * copy require-ingress-https Signed-off-by: Chandan-DK <[email protected]> * add kyverno tests for require-ingress-https Signed-off-by: Chandan-DK <[email protected]> * convert require-ingress-https to cel Signed-off-by: Chandan-DK <[email protected]> * copy require-pod-priorityclassname Signed-off-by: Chandan-DK <[email protected]> * convert require-pod-priorityclassname to cel Signed-off-by: Chandan-DK <[email protected]> * copy require-qos-burstable Signed-off-by: Chandan-DK <[email protected]> * convert require-qos-burstable to cel Signed-off-by: Chandan-DK <[email protected]> * copy require-storageclass Signed-off-by: Chandan-DK <[email protected]> * convert require-storageclass to cel Signed-off-by: Chandan-DK <[email protected]> * rename files for clarity Signed-off-by: Chandan-DK <[email protected]> * add a new line at the end of files Signed-off-by: Chandan-DK <[email protected]> * update digest Signed-off-by: Chandan-DK <[email protected]> * add corresponding kyverno tests in other folder Signed-off-by: Chandan-DK <[email protected]> * use has() in cel expression for readability Signed-off-by: Chandan-DK <[email protected]> * remove extra whitespace and line Signed-off-by: Chandan-DK <[email protected]> * resolve conflicts Signed-off-by: Chandan-DK <[email protected]> * remove duplicate tests Signed-off-by: Chandan-DK <[email protected]> --------- Signed-off-by: Chandan-DK <[email protected]> Co-authored-by: Mariam Fahmy <[email protected]>
kyverno · May 30, 2024 · c2fc68a · c2fc68a
1 parent 8ce3280
commit c2fc68a
Show file tree

Hide file tree

Showing 72 changed files with 2,698 additions and 10 deletions.
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -55,6 +55,7 @@ jobs:
           - ^other$/^[m-q]
           - ^other-cel$/^[m-q]
           - ^other$/^re[c-q]
+          - ^other-cel$/^re[c-q]
           - ^other$/^res
           - ^other$/^[s-z]
           - ^pod-security$

diff --git a/other-cel/require-annotations/.chainsaw-test/chainsaw-test.yaml b/other-cel/require-annotations/.chainsaw-test/chainsaw-test.yaml
@@ -0,0 +1,39 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  creationTimestamp: null
+  name: require-annotations
+spec:
+  steps:
+  - name: step-01
+    try:
+    - apply:
+        file: ../require-annotations.yaml
+    - patch:
+        resource:
+          apiVersion: kyverno.io/v1
+          kind: ClusterPolicy
+          metadata:
+            name: require-annotations
+          spec:
+            validationFailureAction: Enforce
+    - assert:
+        file: policy-ready.yaml
+  - name: step-02
+    try:
+    - apply:
+        file: pod-good.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: pod-bad.yaml
+    - apply:
+        file: podcontroller-good.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: podcontroller-bad.yaml
+
diff --git a/other-cel/require-annotations/.chainsaw-test/pod-bad.yaml b/other-cel/require-annotations/.chainsaw-test/pod-bad.yaml
@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  annotations:
+    corp.org/department: ""
+  name: badpod01
+spec:
+  containers:
+  - name: busybox
+    image: busybox:1.35
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: badpod02
+spec:
+  containers:
+  - name: busybox
+    image: busybox:1.35
+
diff --git a/other-cel/require-annotations/.chainsaw-test/pod-good.yaml b/other-cel/require-annotations/.chainsaw-test/pod-good.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  annotations:
+    corp.org/department: "foo"
+  name: goodpod01
+spec:
+  containers:
+  - name: busybox
+    image: busybox:1.35
+
diff --git a/other-cel/require-annotations/.chainsaw-test/podcontroller-bad.yaml b/other-cel/require-annotations/.chainsaw-test/podcontroller-bad.yaml
@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: busybox
+  name: baddeployment01
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: busybox
+  strategy: {}
+  template:
+    metadata:
+      annotations:
+        corp.org/department: ""
+      labels:
+        app: busybox
+    spec:
+      containers:
+      - name: busybox
+        image: busybox:1.35
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: badcronjob01
+spec:
+  schedule: "* * * * *"
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+        spec:
+          containers:
+          - name: busybox
+            image: busybox:1.35
+          restartPolicy: OnFailure
+
diff --git a/other-cel/require-annotations/.chainsaw-test/podcontroller-good.yaml b/other-cel/require-annotations/.chainsaw-test/podcontroller-good.yaml
@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: busybox
+  name: gooddeployment01
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: busybox
+  strategy: {}
+  template:
+    metadata:
+      annotations:
+        corp.org/department: "foo"
+      labels:
+        app: busybox
+    spec:
+      containers:
+      - name: busybox
+        image: busybox:1.35
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: goodcronjob01
+spec:
+  schedule: "* * * * *"
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          annotations:
+            corp.org/department: "foo"
+        spec:
+          containers:
+          - name: busybox
+            image: busybox:1.35
+          restartPolicy: OnFailure
+
diff --git a/other-cel/require-annotations/.chainsaw-test/policy-ready.yaml b/other-cel/require-annotations/.chainsaw-test/policy-ready.yaml
@@ -0,0 +1,7 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: require-annotations
+status:
+  ready: true
+
diff --git a/other-cel/require-annotations/.kyverno-test/kyverno-test.yaml b/other-cel/require-annotations/.kyverno-test/kyverno-test.yaml
@@ -0,0 +1,50 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: require-annotations
+policies:
+- ../require-annotations.yaml
+resources:
+- ../.chainsaw-test/pod-bad.yaml
+- ../.chainsaw-test/pod-good.yaml
+- ../.chainsaw-test/podcontroller-bad.yaml
+- ../.chainsaw-test/podcontroller-good.yaml
+results:
+- kind: Pod
+  policy: require-annotations
+  resources:
+  - badpod01
+  - badpod02
+  result: fail
+  rule: check-for-annotation
+- kind: Pod
+  policy: require-annotations
+  resources:
+  - goodpod01
+  result: pass
+  rule: check-for-annotation
+- kind: Deployment
+  policy: require-annotations
+  resources:
+  - baddeployment01
+  result: fail
+  rule: check-for-annotation
+- kind: CronJob
+  policy: require-annotations
+  resources:
+  - badcronjob01
+  result: fail
+  rule: check-for-annotation
+- kind: Deployment
+  policy: require-annotations
+  resources:
+  - gooddeployment01
+  result: pass
+  rule: check-for-annotation
+- kind: CronJob
+  policy: require-annotations
+  resources:
+  - goodcronjob01
+  result: pass
+  rule: check-for-annotation
+
diff --git a/other-cel/require-annotations/artifacthub-pkg.yml b/other-cel/require-annotations/artifacthub-pkg.yml
@@ -0,0 +1,24 @@
+name: require-annotations-cel
+version: 1.0.0
+displayName: Require Annotations in CEL expressions
+description: >-
+  Define and use annotations that identify semantic attributes of your application or Deployment. A common set of annotations allows tools to work collaboratively, describing objects in a common manner that all tools can understand. The recommended annotations describe applications in a way that can be queried. This policy validates that the annotation `corp.org/department` is specified with some value.      
+install: |-
+  ```shell
+  kubectl apply -f https://raw.githubusercontent.com/kyverno/policies/main/other-cel/require-annotations/require-annotations.yaml
+  ```
+keywords:
+  - kyverno
+  - Other
+  - CEL Expressions
+readme: |
+  Define and use annotations that identify semantic attributes of your application or Deployment. A common set of annotations allows tools to work collaboratively, describing objects in a common manner that all tools can understand. The recommended annotations describe applications in a way that can be queried. This policy validates that the annotation `corp.org/department` is specified with some value.      
+  
+  Refer to the documentation for more details on Kyverno annotations: https://artifacthub.io/docs/topics/annotations/kyverno/
+annotations:
+  kyverno/category: "Other in CEL"
+  kyverno/kubernetesVersion: "1.26-1.27"
+  kyverno/subject: "Pod, Annotation"
+digest: dc8408d4a7a929f2f142b174a2ea06148f4dbd65ab16d70870a2213919dadf9d
+createdAt: "2024-04-09T15:56:35Z"
+
diff --git a/other-cel/require-annotations/require-annotations.yaml b/other-cel/require-annotations/require-annotations.yaml
@@ -0,0 +1,34 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: require-annotations
+  annotations:
+    policies.kyverno.io/title: Require Annotations in CEL expressions
+    policies.kyverno.io/category: Other in CEL 
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod, Annotation
+    kyverno.io/kyverno-version: 1.11.0
+    kyverno.io/kubernetes-version: "1.26-1.27"
+    policies.kyverno.io/description: >-
+      Define and use annotations that identify semantic attributes of your application or Deployment.
+      A common set of annotations allows tools to work collaboratively, describing objects in a common manner that
+      all tools can understand. The recommended annotations describe applications in a way that can be
+      queried. This policy validates that the annotation `corp.org/department` is specified with some value.      
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+  - name: check-for-annotation
+    match:
+      any:
+      - resources:
+          kinds:
+          - Pod
+    validate:
+      cel:
+        expressions:
+          - expression: >-
+              has(object.metadata.annotations) && 
+              'corp.org/department' in object.metadata.annotations && object.metadata.annotations['corp.org/department'] != ''
+            message: "The annotation `corp.org/department` is required."
+
diff --git a/other-cel/require-deployments-have-multiple-replicas/.chainsaw-test/chainsaw-test.yaml b/other-cel/require-deployments-have-multiple-replicas/.chainsaw-test/chainsaw-test.yaml
@@ -0,0 +1,32 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  creationTimestamp: null
+  name: require-deployments-have-multiple-replicas
+spec:
+  steps:
+  - name: step-01
+    try:
+    - apply:
+        file: ../require-deployments-have-multiple-replicas.yaml
+    - patch:
+        resource:
+          apiVersion: kyverno.io/v1
+          kind: ClusterPolicy
+          metadata:
+            name: deployment-has-multiple-replicas
+          spec:
+            validationFailureAction: Enforce
+    - assert:
+        file: policy-ready.yaml
+  - name: step-02
+    try:
+    - apply:
+        file: deploy-good.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: deploy-bad.yaml
+
diff --git a/other-cel/require-deployments-have-multiple-replicas/.chainsaw-test/deploy-bad.yaml b/other-cel/require-deployments-have-multiple-replicas/.chainsaw-test/deploy-bad.yaml
@@ -0,0 +1,68 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: busybox
+  name: baddeployment01
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: busybox
+  strategy: {}
+  template:
+    metadata:
+      labels:
+        app: busybox
+    spec:
+      containers:
+      - name: busybox
+        image: busybox:1.35
+      - name: busybox02
+        image: busybox:1.35
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: busybox
+  name: baddeployment02
+spec:
+  replicas: 0
+  selector:
+    matchLabels:
+      app: busybox
+  strategy: {}
+  template:
+    metadata:
+      labels:
+        app: busybox
+    spec:
+      containers:
+      - name: busybox
+        image: busybox:1.35
+      - name: busybox02
+        image: busybox:1.35
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: busybox
+  name: baddeployment03
+spec:
+  selector:
+    matchLabels:
+      app: busybox
+  strategy: {}
+  template:
+    metadata:
+      labels:
+        app: busybox
+    spec:
+      containers:
+      - name: busybox
+        image: busybox:1.35
+      - name: busybox02
+        image: busybox:1.35
+