suite: container security context test
templates:
  - common.yaml
release:
  name: test-release-name
  namespace: test-release-namespace
tests:
  - it: should create the securityContext correctly
    set:
      image: &image
        repository: nginx
        tag: 1.19.0
        pullPolicy: IfNotPresent
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: &probes
                  liveness:
                    enabled: false
                  readiness:
                    enabled: false
                  startup:
                    enabled: false
    asserts:
      - documentIndex: &deploymentDoc 0
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        isAPIVersion:
          of: apps/v1
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[0]
          content:
            securityContext:
              runAsUser: 568
              runAsGroup: 568
              readOnlyRootFilesystem: true
              allowPrivilegeEscalation: false
              privileged: false
              runAsNonRoot: true
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                add: []
                drop:
                  - ALL

  - it: should override the securityContext runAsUser and runAsNonRoot
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  runAsUser: 0
                  runAsNonRoot: false
    asserts:
      - documentIndex: &deploymentDoc 0
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        isAPIVersion:
          of: apps/v1
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[0]
          content:
            securityContext:
              runAsUser: 0
              runAsGroup: 568
              readOnlyRootFilesystem: true
              allowPrivilegeEscalation: false
              privileged: false
              runAsNonRoot: false
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                add:
                  - CHOWN
                  - SETUID
                  - SETGID
                  - FOWNER
                  - DAC_OVERRIDE
                drop:
                  - ALL

  - it: should override the securityContext runAsGroup and runAsNonRoot
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  runAsGroup: 0
                  runAsNonRoot: false
    asserts:
      - documentIndex: &deploymentDoc 0
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        isAPIVersion:
          of: apps/v1
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[0]
          content:
            securityContext:
              runAsUser: 568
              runAsGroup: 0
              readOnlyRootFilesystem: true
              allowPrivilegeEscalation: false
              privileged: false
              runAsNonRoot: false
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                add: []
                drop:
                  - ALL

  - it: should override the securityContext readOnlyRootFilesystem
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  readOnlyRootFilesystem: false
    asserts:
      - documentIndex: &deploymentDoc 0
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        isAPIVersion:
          of: apps/v1
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[0]
          content:
            securityContext:
              runAsUser: 568
              runAsGroup: 568
              readOnlyRootFilesystem: false
              allowPrivilegeEscalation: false
              privileged: false
              runAsNonRoot: true
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                add: []
                drop:
                  - ALL

  - it: should override the securityContext privileged
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  privileged: true
    asserts:
      - documentIndex: &deploymentDoc 0
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        isAPIVersion:
          of: apps/v1
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[0]
          content:
            securityContext:
              runAsUser: 568
              runAsGroup: 568
              readOnlyRootFilesystem: true
              allowPrivilegeEscalation: true
              privileged: true
              runAsNonRoot: true
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                add: []
                drop:
                  - ALL

  - it: should override the securityContext allowPrivilegeEscalation
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  allowPrivilegeEscalation: true
    asserts:
      - documentIndex: &deploymentDoc 0
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        isAPIVersion:
          of: apps/v1
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[0]
          content:
            securityContext:
              runAsUser: 568
              runAsGroup: 568
              readOnlyRootFilesystem: true
              allowPrivilegeEscalation: true
              privileged: false
              runAsNonRoot: true
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                add: []
                drop:
                  - ALL

  - it: should override the securityContext capabilities.add
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  capabilities:
                    add:
                      - NET_ADMIN
    asserts:
      - documentIndex: &deploymentDoc 0
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        isAPIVersion:
          of: apps/v1
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[0]
          content:
            securityContext:
              runAsUser: 568
              runAsGroup: 568
              readOnlyRootFilesystem: true
              allowPrivilegeEscalation: false
              privileged: false
              runAsNonRoot: true
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                add:
                  - NET_ADMIN
                drop:
                  - ALL

  - it: should override the securityContext capabilities.drop
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  capabilities:
                    drop:
                      - NET_ADMIN
    asserts:
      - documentIndex: &deploymentDoc 0
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        isAPIVersion:
          of: apps/v1
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[0]
          content:
            securityContext:
              runAsUser: 568
              runAsGroup: 568
              readOnlyRootFilesystem: true
              allowPrivilegeEscalation: false
              privileged: false
              runAsNonRoot: true
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                add: []
                drop:
                  - NET_ADMIN

  - it: should override the securityContext seccompProfile.type
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  seccompProfile:
                    type: Unconfined
    asserts:
      - documentIndex: &deploymentDoc 0
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        isAPIVersion:
          of: apps/v1
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[0]
          content:
            securityContext:
              runAsUser: 568
              runAsGroup: 568
              readOnlyRootFilesystem: true
              allowPrivilegeEscalation: false
              privileged: false
              runAsNonRoot: true
              seccompProfile:
                type: Unconfined
              capabilities:
                add: []
                drop:
                  - ALL

  - it: should override the securityContext all
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  runAsUser: 1000
                  runAsGroup: 1000
                  readOnlyRootFilesystem: false
                  allowPrivilegeEscalation: true
                  privileged: true
                  capabilities:
                    add:
                      - NET_ADMIN
                    drop:
                      - NET_BIND_SERVICE
                  seccompProfile:
                    type: Localhost
                    profile: path/to/profile.json
    asserts:
      - documentIndex: &deploymentDoc 0
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        isAPIVersion:
          of: apps/v1
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[0]
          content:
            securityContext:
              runAsUser: 1000
              runAsGroup: 1000
              readOnlyRootFilesystem: false
              allowPrivilegeEscalation: true
              privileged: true
              runAsNonRoot: true
              seccompProfile:
                type: Localhost
                localhostProfile: path/to/profile.json
              capabilities:
                add:
                  - NET_ADMIN
                drop:
                  - NET_BIND_SERVICE

  - it: should set allowPrivilegeEscalation to true automatically when privileged is true
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  allowPrivilegeEscalation: false
                  privileged: true
    asserts:
      - documentIndex: &deploymentDoc 0
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        isAPIVersion:
          of: apps/v1
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[0]
          content:
            securityContext:
              runAsUser: 568
              runAsGroup: 568
              readOnlyRootFilesystem: true
              allowPrivilegeEscalation: true
              privileged: true
              runAsNonRoot: true
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                add: []
                drop:
                  - ALL

  - it: should set to privileged with assigned device on primary
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
      persistence:
        dev01:
          enabled: true
          type: device
          hostPath: /dev/sda
          mountPath: /test
    asserts:
      - documentIndex: &deploymentDoc 0
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        isAPIVersion:
          of: apps/v1
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[0]
          content:
            securityContext:
              runAsUser: 0
              runAsGroup: 0
              readOnlyRootFilesystem: true
              allowPrivilegeEscalation: true
              privileged: true
              runAsNonRoot: false
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                add:
                  - CHOWN
                  - SETUID
                  - SETGID
                  - FOWNER
                  - DAC_OVERRIDE
                drop:
                  - ALL

  - it: should not include extra caps when disabled from global
    set:
      image: *image
      securityContext:
        container:
          runAsNonRoot: false
          runAsUser: 0
          runAsGroup: 0
          capabilities:
            disableS6Caps: true
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
    asserts:
      - documentIndex: &deploymentDoc 0
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        isAPIVersion:
          of: apps/v1
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[0]
          content:
            securityContext:
              runAsUser: 0
              runAsGroup: 0
              readOnlyRootFilesystem: true
              allowPrivilegeEscalation: false
              privileged: false
              runAsNonRoot: false
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                add: []
                drop:
                  - ALL

  - it: should not include extra caps when disabled from container level
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  runAsNonRoot: false
                  runAsUser: 0
                  runAsGroup: 0
                  capabilities:
                    disableS6Caps: true
    asserts:
      - documentIndex: &deploymentDoc 0
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        isAPIVersion:
          of: apps/v1
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[0]
          content:
            securityContext:
              runAsUser: 0
              runAsGroup: 0
              readOnlyRootFilesystem: true
              allowPrivilegeEscalation: false
              privileged: false
              runAsNonRoot: false
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                add: []
                drop:
                  - ALL

  - it: should set to privileged with assigned device on selected container
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
              container-name2:
                enabled: true
                primary: false
                imageSelector: image
                probes: *probes
      persistence:
        dev01:
          enabled: true
          type: device
          hostPath: /dev/sda
          mountPath: /test
          targetSelector:
            workload-name1:
              container-name2: {}
    asserts:
      - documentIndex: &deploymentDoc 0
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        isAPIVersion:
          of: apps/v1
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[0]
          content:
            securityContext:
              runAsUser: 568
              runAsGroup: 568
              readOnlyRootFilesystem: true
              allowPrivilegeEscalation: false
              privileged: false
              runAsNonRoot: true
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                add: []
                drop:
                  - ALL
      - documentIndex: *deploymentDoc
        isSubset:
          path: spec.template.spec.containers[1]
          content:
            securityContext:
              runAsUser: 0
              runAsGroup: 0
              readOnlyRootFilesystem: true
              allowPrivilegeEscalation: true
              privileged: true
              runAsNonRoot: false
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                add:
                  - CHOWN
                  - SETUID
                  - SETGID
                  - FOWNER
                  - DAC_OVERRIDE
                drop:
                  - ALL

  # Failures
  - it: should fail with empty securityContext
    set:
      image: *image
      securityContext:
        container:
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
    asserts:
      - failedTemplate:
          errorMessage: Container - Expected non-empty [.Values.securityContext.container]

  - it: should fail with readOnlyRootFilesystem not a bool
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  readOnlyRootFilesystem: "true"
    asserts:
      - failedTemplate:
          errorMessage: Container - Expected [securityContext.readOnlyRootFilesystem] to be [bool], but got [true] of type [string]

  - it: should fail with allowPrivilegeEscalation not a bool
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  allowPrivilegeEscalation: "true"
    asserts:
      - failedTemplate:
          errorMessage: Container - Expected [securityContext.allowPrivilegeEscalation] to be [bool], but got [true] of type [string]

  - it: should fail with privileged not a bool
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  privileged: "true"
    asserts:
      - failedTemplate:
          errorMessage: Container - Expected [securityContext.privileged] to be [bool], but got [true] of type [string]

  - it: should fail with runAsUser not an int
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  runAsUser: "568"
    asserts:
      - failedTemplate:
          errorMessage: Container - Expected [securityContext.runAsUser] to be [int], but got [568] of type [string]

  - it: should fail with runAsGroup not an int
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  runAsGroup: "568"
    asserts:
      - failedTemplate:
          errorMessage: Container - Expected [securityContext.runAsGroup] to be [int], but got [568] of type [string]

  - it: should fail without seccompProfile
    set:
      image: *image
      securityContext:
        container:
          seccompProfile:
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
    asserts:
      - failedTemplate:
          errorMessage: Container - Expected [securityContext.seccompProfile] to be defined

  - it: should fail with invalid seccompProfile
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  seccompProfile:
                    type: invalid
    asserts:
      - failedTemplate:
          errorMessage: Container - Expected [securityContext.seccompProfile] to be one of [RuntimeDefault, Localhost, Unconfined], but got [invalid]

  - it: should fail without profile on seccompProfile Localhost
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  seccompProfile:
                    type: Localhost
                    profile: ""
    asserts:
      - failedTemplate:
          errorMessage: Container - Expected [securityContext.seccompProfile.profile] to be defined on type [Localhost]

  - it: should fail without capabilities
    set:
      image: *image
      securityContext:
        container:
          capabilities:
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
    asserts:
      - failedTemplate:
          errorMessage: Container - Expected [securityContext.capabilities] to be defined

  - it: should fail capabilities.add not a list
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  capabilities:
                    add: invalid
    asserts:
      - failedTemplate:
          errorMessage: Container - Expected [securityContext.capabilities.add] to be [list], but got [string]

  - it: should fail capabilities.drop not a list
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  capabilities:
                    drop: invalid
    asserts:
      - failedTemplate:
          errorMessage: Container - Expected [securityContext.capabilities.drop] to be [list], but got [string]

  - it: should fail capabilities.disableS6Caps not a bool
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  runAsUser: 0
                  runAsGroup: 0
                  runAsNonRoot: false
                  capabilities:
                    disableS6Caps: not-bool
    asserts:
      - failedTemplate:
          errorMessage: Container - Expected [securityContext.capabilities.disableS6Caps] to be [bool], but got [not-bool] of type [string]

  - it: should fail with duplicate capabilities.add
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  capabilities:
                    add:
                      - CHOWN
                      - CHOWN
    asserts:
      - failedTemplate:
          errorMessage: Container - Expected items of [securityContext.capabilities.add] to be unique, but got [CHOWN, CHOWN]

  - it: should fail with duplicate capabilities.drop
    set:
      image: *image
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            containers:
              container-name1:
                enabled: true
                primary: true
                imageSelector: image
                probes: *probes
                securityContext:
                  capabilities:
                    drop:
                      - CHOWN
                      - CHOWN
    asserts:
      - failedTemplate:
          errorMessage: Container - Expected items of [securityContext.capabilities.drop] to be unique, but got [CHOWN, CHOWN]
