Kjeld Schouten
1057 lines
30 KiB
YAML
1057 lines
30 KiB
YAML
suite: container security context test
|
|
templates:
|
|
- common.yaml
|
|
release:
|
|
name: test-release-name
|
|
namespace: test-release-namespace
|
|
tests:
|
|
- it: should create the securityContext correctly
|
|
set:
|
|
image: &image
|
|
repository: nginx
|
|
tag: 1.19.0
|
|
pullPolicy: IfNotPresent
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: &probes
|
|
liveness:
|
|
enabled: false
|
|
readiness:
|
|
enabled: false
|
|
startup:
|
|
enabled: false
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext runAsUser and runAsNonRoot
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
runAsUser: 0
|
|
runAsNonRoot: false
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 0
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: false
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add:
|
|
- CHOWN
|
|
- SETUID
|
|
- SETGID
|
|
- FOWNER
|
|
- DAC_OVERRIDE
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext runAsGroup and runAsNonRoot
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
runAsGroup: 0
|
|
runAsNonRoot: false
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 0
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: false
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext readOnlyRootFilesystem
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
readOnlyRootFilesystem: false
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: false
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext privileged
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
privileged: true
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: true
|
|
privileged: true
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext allowPrivilegeEscalation
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
allowPrivilegeEscalation: true
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: true
|
|
privileged: false
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext capabilities.add
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext capabilities.drop
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
capabilities:
|
|
drop:
|
|
- NET_ADMIN
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- NET_ADMIN
|
|
|
|
- it: should override the securityContext seccompProfile.type
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
seccompProfile:
|
|
type: Unconfined
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: Unconfined
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should override the securityContext all
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
readOnlyRootFilesystem: false
|
|
allowPrivilegeEscalation: true
|
|
privileged: true
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
drop:
|
|
- NET_BIND_SERVICE
|
|
seccompProfile:
|
|
type: Localhost
|
|
profile: path/to/profile.json
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
readOnlyRootFilesystem: false
|
|
allowPrivilegeEscalation: true
|
|
privileged: true
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: Localhost
|
|
localhostProfile: path/to/profile.json
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
drop:
|
|
- NET_BIND_SERVICE
|
|
|
|
- it: should set allowPrivilegeEscalation to true automatically when privileged is true
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
privileged: true
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: true
|
|
privileged: true
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should set to privileged with assigned device on primary
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
persistence:
|
|
dev01:
|
|
enabled: true
|
|
type: device
|
|
hostPath: /dev/sda
|
|
mountPath: /test
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: true
|
|
privileged: true
|
|
runAsNonRoot: false
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add:
|
|
- CHOWN
|
|
- SETUID
|
|
- SETGID
|
|
- FOWNER
|
|
- DAC_OVERRIDE
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should not include extra caps when disabled from global
|
|
set:
|
|
image: *image
|
|
securityContext:
|
|
container:
|
|
runAsNonRoot: false
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
capabilities:
|
|
disableS6Caps: true
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: false
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should not include extra caps when disabled from container level
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
runAsNonRoot: false
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
capabilities:
|
|
disableS6Caps: true
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: false
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
|
|
- it: should set to privileged with assigned device on selected container
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
container-name2:
|
|
enabled: true
|
|
primary: false
|
|
imageSelector: image
|
|
probes: *probes
|
|
persistence:
|
|
dev01:
|
|
enabled: true
|
|
type: device
|
|
hostPath: /dev/sda
|
|
mountPath: /test
|
|
targetSelector:
|
|
workload-name1:
|
|
container-name2: {}
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
isAPIVersion:
|
|
of: apps/v1
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[0]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 568
|
|
runAsGroup: 568
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add: []
|
|
drop:
|
|
- ALL
|
|
- documentIndex: *deploymentDoc
|
|
isSubset:
|
|
path: spec.template.spec.containers[1]
|
|
content:
|
|
securityContext:
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: true
|
|
privileged: true
|
|
runAsNonRoot: false
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
add:
|
|
- CHOWN
|
|
- SETUID
|
|
- SETGID
|
|
- FOWNER
|
|
- DAC_OVERRIDE
|
|
drop:
|
|
- ALL
|
|
|
|
# Failures
|
|
- it: should fail with empty securityContext
|
|
set:
|
|
image: *image
|
|
securityContext:
|
|
container:
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected non-empty [.Values.securityContext.container]
|
|
|
|
- it: should fail with readOnlyRootFilesystem not a bool
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
readOnlyRootFilesystem: "true"
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected [securityContext.readOnlyRootFilesystem] to be [bool], but got [true] of type [string]
|
|
|
|
- it: should fail with allowPrivilegeEscalation not a bool
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
allowPrivilegeEscalation: "true"
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected [securityContext.allowPrivilegeEscalation] to be [bool], but got [true] of type [string]
|
|
|
|
- it: should fail with privileged not a bool
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
privileged: "true"
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected [securityContext.privileged] to be [bool], but got [true] of type [string]
|
|
|
|
- it: should fail with runAsUser not an int
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
runAsUser: "568"
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected [securityContext.runAsUser] to be [int], but got [568] of type [string]
|
|
|
|
- it: should fail with runAsGroup not an int
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
runAsGroup: "568"
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected [securityContext.runAsGroup] to be [int], but got [568] of type [string]
|
|
|
|
- it: should fail without seccompProfile
|
|
set:
|
|
image: *image
|
|
securityContext:
|
|
container:
|
|
seccompProfile:
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected [securityContext.seccompProfile] to be defined
|
|
|
|
- it: should fail with invalid seccompProfile
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
seccompProfile:
|
|
type: invalid
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected [securityContext.seccompProfile] to be one of [RuntimeDefault, Localhost, Unconfined], but got [invalid]
|
|
|
|
- it: should fail without profile on seccompProfile Localhost
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
seccompProfile:
|
|
type: Localhost
|
|
profile: ""
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected [securityContext.seccompProfile.profile] to be defined on type [Localhost]
|
|
|
|
- it: should fail without capabilities
|
|
set:
|
|
image: *image
|
|
securityContext:
|
|
container:
|
|
capabilities:
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected [securityContext.capabilities] to be defined
|
|
|
|
- it: should fail capabilities.add not a list
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
capabilities:
|
|
add: invalid
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected [securityContext.capabilities.add] to be [list], but got [string]
|
|
|
|
- it: should fail capabilities.drop not a list
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
capabilities:
|
|
drop: invalid
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected [securityContext.capabilities.drop] to be [list], but got [string]
|
|
|
|
- it: should fail capabilities.disableS6Caps not a bool
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
runAsNonRoot: false
|
|
capabilities:
|
|
disableS6Caps: not-bool
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected [securityContext.capabilities.disableS6Caps] to be [bool], but got [not-bool] of type [string]
|
|
|
|
- it: should fail with duplicate capabilities.add
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
capabilities:
|
|
add:
|
|
- CHOWN
|
|
- CHOWN
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected items of [securityContext.capabilities.add] to be unique, but got [CHOWN, CHOWN]
|
|
|
|
- it: should fail with duplicate capabilities.drop
|
|
set:
|
|
image: *image
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container-name1:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: image
|
|
probes: *probes
|
|
securityContext:
|
|
capabilities:
|
|
drop:
|
|
- CHOWN
|
|
- CHOWN
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Container - Expected items of [securityContext.capabilities.drop] to be unique, but got [CHOWN, CHOWN]
|