mirror of
https://github.com/kata-containers/kata-containers.git
synced 2025-04-28 11:44:38 +00:00
tests: k8s: rename hard-coded policy test script
Rename k8s-exec-rejected.bats to k8s-policy-hard-coded.bats, getting ready to test additional hard-coded policies using the same script. Signed-off-by: Dan Mihai <dmihai@microsoft.com>
This commit is contained in:
parent
7b691455c2
commit
3e348e9768
@ -12,13 +12,13 @@ setup() {
|
||||
hard_coded_policy_tests_enabled || skip "Policy tests are disabled."
|
||||
|
||||
get_pod_config_dir
|
||||
pod_name="policy-exec-rejected"
|
||||
pod_yaml="${pod_config_dir}/k8s-policy-exec-rejected.yaml"
|
||||
allow_all_except_exec_policy=$(base64 -w 0 "${pod_config_dir}/allow-all-except-exec-process.rego")
|
||||
pod_name="hard-coded-policy-pod"
|
||||
pod_yaml="${pod_config_dir}/k8s-policy-hard-coded.yaml"
|
||||
}
|
||||
|
||||
@test "Kubectl exec rejected by policy" {
|
||||
# Add to the YAML file a policy that rejects ExecProcessRequest.
|
||||
allow_all_except_exec_policy=$(base64 -w 0 "${pod_config_dir}/allow-all-except-exec-process.rego")
|
||||
yq -i \
|
||||
".metadata.annotations.\"io.katacontainers.config.agent.policy\" = \"${allow_all_except_exec_policy}\"" \
|
||||
"${pod_yaml}"
|
@ -41,7 +41,6 @@ else
|
||||
"k8s-empty-dirs.bats" \
|
||||
"k8s-env.bats" \
|
||||
"k8s-exec.bats" \
|
||||
"k8s-exec-rejected.bats" \
|
||||
"k8s-file-volume.bats" \
|
||||
"k8s-inotify.bats" \
|
||||
"k8s-job.bats" \
|
||||
@ -56,6 +55,7 @@ else
|
||||
"k8s-optional-empty-secret.bats" \
|
||||
"k8s-pid-ns.bats" \
|
||||
"k8s-pod-quota.bats" \
|
||||
"k8s-policy-hard-coded.bats" \
|
||||
"k8s-policy-job.bats" \
|
||||
"k8s-policy-pod.bats" \
|
||||
"k8s-policy-pvc.bats" \
|
||||
|
@ -6,7 +6,7 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: policy-exec-rejected
|
||||
name: hard-coded-policy-pod
|
||||
spec:
|
||||
terminationGracePeriodSeconds: 0
|
||||
shareProcessNamespace: true
|
Loading…
Reference in New Issue
Block a user