mirror of
https://github.com/truenas/charts.git
synced 2026-04-05 11:48:55 +08:00
5b1abdd839
* fix
* fix
* some more
* somefixs
* whops
* initial structure
* finish up configmap
* secret class
* runtest secret
* move files arround
* ignore
* make clear on call template that need root context
* imagePullSecret (minus targetSelector)
* move out of the way
* clean up comment
* deployment basic spec
* daemonset basic spec
* statefulset spec
* split file
* docs
* update values
* job spec
* job docs
* cronJob basic spec
* job in cron test
* add common version
* podsepc
* whoopsis
* selectorlabels and pod metadata
* job and cron pod metadata
* update docs
* consistent order
* get ready for pod
* first targetSelector
* remove todo
* update docs
* add hostnet and enableservicelinks
* update selector logic
* update docs
* add tests for restartpolicy
* schedulerName
* priorityclassname
* hostname
* termperiodsec
* nodeselector
* add fail case
* host aliases
* dns policy
* dns config
* tolerations
* serviceaccoutn class, spawner, saname selector
* add pod todo
* update some tests
* add runtimeclassname
* controllers -> workload and plurar to singular
* require at least 1 primary on enabled SAs
* fix script
* remove wrong comment
* update naming scheme
* update rbac values ref
* rbac docs
* rbac's
* append short name, for future use
* update comments
* initial service wireframe
* shorten line
* simplify labels and update tests
* service selectors
* simplify error messages
* finish clusterIP type
* loadbalancer
* noedport
* externalname
* external ip
* update service
* fix highlighting
* session affinity
* add comment
* update comments
* service ports
* fix indentation
* externalname can have no ports
* fixup externalIP
* add pvc class and spawner and tests
* add nfs and emptyDir vols
* example
* extend docs a bit
* not create pvc if existing claim is set
* helm... you are dumb really. how this fixes an unrelated test
* add configmap
* add secret vol
* add pvc vol
* add hostpath
* finish volumes
* initial podsec
* podsec context with some todo's to check
* automatic sysctls
* remove todo
* update doc struct
* split docs
* split service docs
* initial container plumbing
* fix tests
* fix test
* rename to class
* command and args
* termination
* add lifecycle
* int value from tpl
* another case
* fix service protocol tpl
* update readme
* ports
* update todo
* cleanup values a bit
* only add sysctl when port is bellow 1024
* whops, thats a different range
* update avlue
* move some old docs to the "to be deleted" dir
* externalinteface validation
* update an error message and apply externalinterface annotations to workloads
* external interfaces
* TZ - TIMEZONE
* update rdoc
* reduce code duple
* device vol type
* initial certificate plumbing
* update comments
* finish secret creation of certificate
* cert dosc
* volumeMounts
* scale certs
* doc
* add tests for volMounts
* values updates
* update todo
* add test case
* remove some todo
* update todos
* vct
* remove tdoo
* restore default
* rename function
* make selectorlabels a bit better
* trim
* some cleanup
* update some ci values
* update ci
* rollingup defaults
* rename dir
* fix nil pointers
* check the same strategy var
* whops
* fix tests
* typo
* not a good day for copy paste
* move check
* move another check
* fix some tests for upcoming probes
* one mroe
* split docs
* add default probes for `main` and docs
* add probes and some ci testruns
* whops
* fix an edge case
* add an error for edge case
* runtests
* runtest updaets
* update
* check if podvalues exist first
* force types
* force only one of the 2
* quote labels and annotaions values
* job/cron have auto gen selectors
* remove false test
* fix maxsureg
* fix end
* different fix
* fix some tests
* fix rollUp
* try to fix 3.9.4 helm
* move file to helpers
* use capital types in probes and lifecycle
* Revert "use capital types in probes and lifecycle"
This reverts commit 380ebd5f1f.
* typo
* use lowercase for protocol everywhere
* rbac runtest
* prune old
* add resources
* add resources
* fix rbc
* fix sa naming in pod
* fix test
* 44 suppl group on gpu
* remove todo
* extract function in another file
* whops
* add securityContext implementation
* add fail cases
* add rest of the tests
* remove todo
* envFrom
* minify
* env list
* add env
* add envdupe check tests
* add fixed envs
* replace containers with callers
* add callers
* add initContainer
* add init run test
* reset default test val
* add name tests
* add some more tests
* rename
* validate workload type only if enabled
* lint fix for 3.9.4
* add tpl on init enabled
* whops
* fix init
* echo
* echo
* args...
* list
* comment out disabled persistences
* fix some typos and improve resources `requests` requirement
* improve docs a bit
* require name,description,version,type
* add some wording regarding what Helm Template column means
* add title as requirement
* remove scheduler
* remove priority class name
* remove nfs + externalIP
* remove LB
* remove STS & VCT
* fix a test
* remove nodeselector
* remove DS
* remove pvc
* remove todo
* conditionally print the type, as we might want to use the template to select all objects inthe chart
* add some docs
* docs for notes
* add `tls.` in the certificate secret, according to k8s docs
* add some basic docs around the rest of the options
* clean values.yaml
* catch an edge case
* remove externalName
* set autmountSA on SA to false
* add note about the automountSA
779 lines
22 KiB
YAML
779 lines
22 KiB
YAML
suite: container security context test
|
|
templates:
|
|
- common.yaml
|
|
tests:
|
|
- it: should create the securityContext correctly
|
|
set:
|
|
image: &image
|
|
repository: nginx
|
|
tag: 1.19.0
|
|
pullPolicy: IfNotPresent
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: &probes
|
|
liveness:
|
|
enabled: false
|
|
readiness:
|
|
enabled: false
|
|
startup:
|
|
enabled: false
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext runAsUser and runAsNonRoot
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
runAsUser: 0
|
|
runAsNonRoot: false
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 0
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: false
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext runAsGroup and runAsNonRoot
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
runAsGroup: 0
|
|
runAsNonRoot: false
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 0
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: false
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext readOnlyRootFilesystem
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
readOnlyRootFilesystem: false
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: false
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext privileged
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
privileged: true
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: true
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext allowPrivilegeEscalation
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
allowPrivilegeEscalation: true
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: true
|
|
privileged: false
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext capabilities.add
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext capabilities.drop
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
capabilities:
|
|
drop:
|
|
- NET_ADMIN
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- NET_ADMIN
|
|
|
|
- it: should override the securityContext seccompProfile.type
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
seccompProfile:
|
|
type: Unconfined
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: Unconfined
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext all
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
readOnlyRootFilesystem: false
|
|
allowPrivilegeEscalation: true
|
|
privileged: true
|
|
runAsNonRoot: false
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
drop:
|
|
- NET_BIND_SERVICE
|
|
seccompProfile:
|
|
type: Localhost
|
|
profile: path/to/profile.json
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
readOnlyRootFilesystem: false
|
|
allowPrivilegeEscalation: true
|
|
privileged: true
|
|
runAsNonRoot: false
|
|
seccompProfile:
|
|
type: Localhost
|
|
localhostProfile: path/to/profile.json
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
drop:
|
|
- NET_BIND_SERVICE
|
|
|
|
# Failures
|
|
- it: should fail with empty securityContext
|
|
set:
|
|
image: *image
|
|
securityContext:
|
|
container:
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected non-empty <.Values.securityContext.container>
|
|
|
|
- it: should fail with runAsNonRoot not a bool
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
runAsNonRoot: "true"
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected <securityContext.runAsNonRoot> to be [bool], but got [true] of type [string]
|
|
|
|
- it: should fail with readOnlyRootFilesystem not a bool
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
readOnlyRootFilesystem: "true"
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected <securityContext.readOnlyRootFilesystem> to be [bool], but got [true] of type [string]
|
|
|
|
- it: should fail with allowPrivilegeEscalation not a bool
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
allowPrivilegeEscalation: "true"
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected <securityContext.allowPrivilegeEscalation> to be [bool], but got [true] of type [string]
|
|
|
|
- it: should fail with privileged not a bool
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
privileged: "true"
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected <securityContext.privileged> to be [bool], but got [true] of type [string]
|
|
|
|
- it: should fail with runAsUser not an int
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
runAsUser: "568"
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected <securityContext.runAsUser> to be [int], but got [568] of type [string]
|
|
|
|
- it: should fail with runAsGroup not an int
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
runAsGroup: "568"
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected <securityContext.runAsGroup> to be [int], but got [568] of type [string]
|
|
|
|
- it: should fail without seccompProfile
|
|
set:
|
|
image: *image
|
|
securityContext:
|
|
container:
|
|
seccompProfile:
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected <securityContext.seccompProfile> to be defined
|
|
|
|
- it: should fail with invalid seccompProfile
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
seccompProfile:
|
|
type: invalid
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected <securityContext.seccompProfile> to be one of [RuntimeDefault, Localhost, Unconfined], but got [invalid]
|
|
|
|
- it: should fail without profile on seccompProfile Localhost
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
seccompProfile:
|
|
type: Localhost
|
|
profile: ""
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected <securityContext.seccompProfile.profile> to be defined on type [Localhost]
|
|
|
|
- it: should fail without capabilities
|
|
set:
|
|
image: *image
|
|
securityContext:
|
|
container:
|
|
capabilities:
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected <securityContext.capabilities> to be defined
|
|
|
|
- it: should fail capabilities.add not a list
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
capabilities:
|
|
add: invalid
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected <securityContext.capabilities.add> to be [list], but got [string]
|
|
|
|
- it: should fail capabilities.drop not a list
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
capabilities:
|
|
drop: invalid
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected <securityContext.capabilities.drop> to be [list], but got [string]
|
|
|
|
- it: should fail when trying to run as non root but with root user
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 0
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected <securityContext.runAsNonRoot> to be [false] with either [runAsUser, runAsGroup] set to [0]
|
|
|
|
- it: should fail when trying to run as non root but with root group
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsGroup: 0
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected <securityContext.runAsNonRoot> to be [false] with either [runAsUser, runAsGroup] set to [0]
|