Merge branch 'main' into test-dbg

kyverno · Aug 28, 2024 · b29c29e · b29c29e
2 parents 1b012ee + c973672
commit b29c29e
Show file tree

Hide file tree

Showing 872 changed files with 6,989 additions and 6,953 deletions.
diff --git a/.github/workflows/cel-test.yml b/.github/workflows/cel-test.yml
@@ -18,16 +18,14 @@ jobs:
       fail-fast: false
       matrix:
         k8s-version:
-          - name: v1.25
-            version: v1.25.16
-          - name: v1.26
-            version: v1.26.14
-          - name: v1.27
-            version: v1.27.11
           - name: v1.28
-            version: v1.28.7
+            version: v1.28.13
           - name: v1.29
-            version: v1.29.2
+            version: v1.29.8
+          - name: v1.30
+            version: v1.30.4
+          - name: v1.31
+            version: v1.31.0
         tests:
           - ^argo-cel$
           - ^aws-cel$

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -18,16 +18,14 @@ jobs:
       fail-fast: false
       matrix:
         k8s-version:
-          - name: v1.25
-            version: v1.25.16
-          - name: v1.26
-            version: v1.26.14
-          - name: v1.27
-            version: v1.27.11
           - name: v1.28
-            version: v1.28.7
+            version: v1.28.13
           - name: v1.29
-            version: v1.29.2
+            version: v1.29.8
+          - name: v1.30
+            version: v1.30.4
+          - name: v1.31
+            version: v1.31.0
         tests:
           - ^argo$/^(application-field-validation|application-prevent-default-project|application-prevent-updates-project|applicationset-name-matches-project|appproject-clusterresourceblacklist|argo-cluster-generation-from-rancher-capi)$
           - ^aws$/^(require-encryption-aws-loadbalancers)$

diff --git a/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-emptydir-vol.yaml b/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-emptydir-vol.yaml
@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: busybox
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     command:
     - sleep
     - "3600"

diff --git a/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-no-volumes.yaml b/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-no-volumes.yaml
@@ -6,7 +6,7 @@ spec:
   automountServiceAccountToken: false
   containers:
   - name: busybox
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     command:
     - sleep
     - "3600"

diff --git a/best-practices-cel/disallow-default-namespace/.chainsaw-test/deploy-default.yaml b/best-practices-cel/disallow-default-namespace/.chainsaw-test/deploy-default.yaml
@@ -16,7 +16,7 @@ spec:
         app: busybox
     spec:
       containers:
-      - image: busybox:v1.35
+      - image: ghcr.io/kyverno/test-busybox:1.35
         name: busybox
         command:
         - "sleep"

diff --git a/best-practices-cel/disallow-default-namespace/.chainsaw-test/ds-default.yaml b/best-practices-cel/disallow-default-namespace/.chainsaw-test/ds-default.yaml
@@ -13,7 +13,7 @@ spec:
         name: good-daemonset
     spec:
       containers:
-      - image: busybox:v1.35
+      - image: ghcr.io/kyverno/test-busybox:1.35
         name: busybox
         command:
         - "sleep"

diff --git a/best-practices-cel/disallow-default-namespace/.chainsaw-test/good-resources.yaml b/best-practices-cel/disallow-default-namespace/.chainsaw-test/good-resources.yaml
@@ -29,7 +29,7 @@ spec:
         app: busybox
     spec:
       containers:
-      - image: busybox:v1.35
+      - image: ghcr.io/kyverno/test-busybox:1.35
         name: busybox
         command:
         - "sleep"
@@ -50,7 +50,7 @@ spec:
         name: good-daemonset
     spec:
       containers:
-      - image: busybox:v1.35
+      - image: ghcr.io/kyverno/test-busybox:1.35
         name: busybox
         command:
         - "sleep"
@@ -65,7 +65,7 @@ spec:
   template:
     spec:
       containers:
-      - image: busybox:v1.35
+      - image: ghcr.io/kyverno/test-busybox:1.35
         name: busybox
         command:
         - "sleep"
@@ -90,7 +90,7 @@ spec:
         app: busybox
     spec:
       containers:
-      - image: busybox:v1.35
+      - image: ghcr.io/kyverno/test-busybox:1.35
         name: busybox
         command:
         - "sleep"

diff --git a/best-practices-cel/disallow-default-namespace/.chainsaw-test/job-default.yaml b/best-practices-cel/disallow-default-namespace/.chainsaw-test/job-default.yaml
@@ -7,7 +7,7 @@ spec:
   template:
     spec:
       containers:
-      - image: busybox:v1.35
+      - image: ghcr.io/kyverno/test-busybox:1.35
         name: busybox
         command:
         - "sleep"

diff --git a/best-practices-cel/disallow-default-namespace/.chainsaw-test/ss-default.yaml b/best-practices-cel/disallow-default-namespace/.chainsaw-test/ss-default.yaml
@@ -16,7 +16,7 @@ spec:
         app: busybox
     spec:
       containers:
-      - image: busybox:v1.35
+      - image: ghcr.io/kyverno/test-busybox:1.35
         name: busybox
         command:
         - "sleep"

diff --git a/best-practices-cel/disallow-helm-tiller/.chainsaw-test/bad-deploy.yaml b/best-practices-cel/disallow-helm-tiller/.chainsaw-test/bad-deploy.yaml
@@ -15,7 +15,7 @@ spec:
         app: busybox
     spec:
       containers:
-      - image: busybox
+      - image: ghcr.io/kyverno/test-busybox
         name: busybox
       - image: docker.io/tiller:latest
         name: helm-tiller

diff --git a/best-practices-cel/disallow-helm-tiller/.chainsaw-test/bad-pod-fail-first.yaml b/best-practices-cel/disallow-helm-tiller/.chainsaw-test/bad-pod-fail-first.yaml
@@ -7,5 +7,5 @@ spec:
   - name: helm-tiller
     image: docker.io/tiller:latest
   - name: somebox
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
 
diff --git a/best-practices-cel/disallow-helm-tiller/.chainsaw-test/bad-pod-success-first.yaml b/best-practices-cel/disallow-helm-tiller/.chainsaw-test/bad-pod-success-first.yaml
@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: somebox
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
   - name: helm-tiller
     image: docker.io/tiller:latest
 
diff --git a/best-practices-cel/disallow-helm-tiller/.chainsaw-test/good-deploy.yaml b/best-practices-cel/disallow-helm-tiller/.chainsaw-test/good-deploy.yaml
@@ -15,7 +15,7 @@ spec:
         app: busybox
     spec:
       containers:
-      - image: busybox:v1.35
+      - image: ghcr.io/kyverno/test-busybox:1.35
         name: busybox
         command: ["sleep", "3600"]
 
diff --git a/best-practices-cel/disallow-helm-tiller/.chainsaw-test/good-pod.yaml b/best-practices-cel/disallow-helm-tiller/.chainsaw-test/good-pod.yaml
@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: busybox
-    image: busybox:v1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
   - name: nothelmbox
-    image: busybox:v1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
 
diff --git a/best-practices-cel/disallow-latest-tag/.chainsaw-test/bad-pod-latest-fail-first.yaml b/best-practices-cel/disallow-latest-tag/.chainsaw-test/bad-pod-latest-fail-first.yaml
@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: busybox
-    image: busybox:latest
+    image: ghcr.io/kyverno/test-busybox:latest
   - name: nginx
-    image: nginx:1.35
+    image: ghcr.io/kyverno/test-nginx:1.35
 
diff --git a/best-practices-cel/disallow-latest-tag/.chainsaw-test/bad-pod-latest-success-first.yaml b/best-practices-cel/disallow-latest-tag/.chainsaw-test/bad-pod-latest-success-first.yaml
@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: nginx
-    image: nginx:1.35
+    image: ghcr.io/kyverno/test-nginx:1.35
   - name: busybox
-    image: busybox:latest
+    image: ghcr.io/kyverno/test-busybox:latest
 
diff --git a/best-practices-cel/disallow-latest-tag/.chainsaw-test/bad-pod-no-tag.yaml b/best-practices-cel/disallow-latest-tag/.chainsaw-test/bad-pod-no-tag.yaml
@@ -5,9 +5,9 @@ metadata:
 spec:
   containers:
   - name: busybox
-    image: busybox
+    image: ghcr.io/kyverno/test-busybox
   - name: nginx
-    image: nginx:1.35
+    image: ghcr.io/kyverno/test-nginx:1.35
 ---
 apiVersion: v1
 kind: Pod
@@ -16,9 +16,9 @@ metadata:
 spec:
   containers:
   - name: nginx
-    image: nginx:1.35
+    image: ghcr.io/kyverno/test-nginx:1.35
   - name: busybox
-    image: busybox
+    image: ghcr.io/kyverno/test-busybox
 ---
 apiVersion: v1
 kind: Pod
@@ -27,7 +27,7 @@ metadata:
 spec:
   containers:
   - name: busybox
-    image: busybox
+    image: ghcr.io/kyverno/test-busybox
   - name: nginx
-    image: nginx:latest
+    image: ghcr.io/kyverno/test-nginx:latest
 
diff --git a/best-practices-cel/disallow-latest-tag/.chainsaw-test/good-pod.yaml b/best-practices-cel/disallow-latest-tag/.chainsaw-test/good-pod.yaml
@@ -5,5 +5,5 @@ metadata:
 spec:
   containers:
   - name: busybox
-    image: busybox:v1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
 
diff --git a/best-practices-cel/require-drop-all/.chainsaw-test/bad-pod-containers.yaml b/best-practices-cel/require-drop-all/.chainsaw-test/bad-pod-containers.yaml
@@ -5,29 +5,29 @@ metadata:
 spec:
   initContainers:
   - name: init
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     securityContext:
       capabilities:
         add: ["SYS_TIME"]
         drop:
           - ALL
   - name: init2
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     securityContext:
       capabilities:
         add: ["SYS_TIME"]
         drop:
           - ALL
   containers:
   - name: add-capabilities
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     securityContext:
       capabilities:
         add: ["SYS_TIME"]
         drop:
           - ALL
   - name: add-capabilities-again
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
 ---
 apiVersion: v1
 kind: Pod
@@ -36,24 +36,24 @@ metadata:
 spec:
   initContainers:
   - name: init
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     securityContext:
       capabilities:
         add: ["SYS_TIME"]
         drop:
           - ALL
   - name: init2
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     securityContext:
       capabilities:
         add: ["SYS_TIME"]
         drop:
           - ALL
   containers:
   - name: add-capabilities-again
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
   - name: add-capabilities
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     securityContext:
       capabilities:
         add: ["SYS_TIME"]

diff --git a/best-practices-cel/require-drop-all/.chainsaw-test/bad-pod-corner.yaml b/best-practices-cel/require-drop-all/.chainsaw-test/bad-pod-corner.yaml
@@ -5,14 +5,14 @@ metadata:
 spec:
   containers:
   - name: add-capabilities
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     securityContext:
       capabilities:
         add: ["SYS_TIME"]
         drop:
           - ALL
   - name: add-capabilities-again
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     securityContext:
       capabilities:
         add: ["SYS_TIME"]
@@ -26,12 +26,12 @@ metadata:
 spec:
   containers:
   - name: add-capabilities
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     securityContext:
       capabilities:
         add: ["SYS_TIME"]
   - name: add-capabilities-again
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     securityContext:
       capabilities:
         add: ["SYS_TIME"]
@@ -45,11 +45,11 @@ metadata:
 spec:
   containers:
   - name: init
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     securityContext:
       capabilities:
         drop:
           - ALL
   - name: init-again
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
 
diff --git a/best-practices-cel/require-drop-all/.chainsaw-test/bad-pod-initcontainers.yaml b/best-practices-cel/require-drop-all/.chainsaw-test/bad-pod-initcontainers.yaml
@@ -5,17 +5,17 @@ metadata:
 spec:
   initContainers:
   - name: init
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     securityContext:
       capabilities:
         add: ["SYS_TIME"]
         drop:
           - ALL
   - name: init2
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
   containers:
   - name: add-capabilities
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     securityContext:
       capabilities:
         add: ["SYS_TIME"]
@@ -29,17 +29,17 @@ metadata:
 spec:
   initContainers:
   - name: init
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
   - name: init2
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     securityContext:
       capabilities:
         add: ["SYS_TIME"]
         drop:
           - ALL
   containers:
   - name: add-capabilities
-    image: busybox:1.35
+    image: ghcr.io/kyverno/test-busybox:1.35
     securityContext:
       capabilities:
         add: ["SYS_TIME"]