tests: k8s: rename hard-coded policy test script

Rename k8s-exec-rejected.bats to k8s-policy-hard-coded.bats, getting
ready to test additional hard-coded policies using the same script.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
This commit is contained in:
Dan Mihai 2024-07-26 17:41:00 +00:00
parent 7b691455c2
commit 3e348e9768
3 changed files with 6 additions and 6 deletions

View File

@ -12,16 +12,16 @@ setup() {
hard_coded_policy_tests_enabled || skip "Policy tests are disabled."
get_pod_config_dir
pod_name="policy-exec-rejected"
pod_yaml="${pod_config_dir}/k8s-policy-exec-rejected.yaml"
allow_all_except_exec_policy=$(base64 -w 0 "${pod_config_dir}/allow-all-except-exec-process.rego")
pod_name="hard-coded-policy-pod"
pod_yaml="${pod_config_dir}/k8s-policy-hard-coded.yaml"
}
@test "Kubectl exec rejected by policy" {
# Add to the YAML file a policy that rejects ExecProcessRequest.
allow_all_except_exec_policy=$(base64 -w 0 "${pod_config_dir}/allow-all-except-exec-process.rego")
yq -i \
".metadata.annotations.\"io.katacontainers.config.agent.policy\" = \"${allow_all_except_exec_policy}\"" \
"${pod_yaml}"
"${pod_yaml}"
# Create the pod
kubectl create -f "${pod_yaml}"

View File

@ -41,7 +41,6 @@ else
"k8s-empty-dirs.bats" \
"k8s-env.bats" \
"k8s-exec.bats" \
"k8s-exec-rejected.bats" \
"k8s-file-volume.bats" \
"k8s-inotify.bats" \
"k8s-job.bats" \
@ -56,6 +55,7 @@ else
"k8s-optional-empty-secret.bats" \
"k8s-pid-ns.bats" \
"k8s-pod-quota.bats" \
"k8s-policy-hard-coded.bats" \
"k8s-policy-job.bats" \
"k8s-policy-pod.bats" \
"k8s-policy-pvc.bats" \

View File

@ -6,7 +6,7 @@
apiVersion: v1
kind: Pod
metadata:
name: policy-exec-rejected
name: hard-coded-policy-pod
spec:
terminationGracePeriodSeconds: 0
shareProcessNamespace: true