mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
Lockdown kata test prints as well as prints of various values (#249)
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
This commit is contained in:
Anand Krishnamoorthi
committed by
GitHub
GitHub
parent
9894f00829
commit
3ac9b1121e
@@ -139,9 +139,10 @@ pub fn eval_file(
|
||||
query: &str,
|
||||
enable_tracing: bool,
|
||||
strict: bool,
|
||||
) -> Result<Vec<Value>> {
|
||||
) -> Result<(Vec<Value>, Vec<String>)> {
|
||||
let mut engine: Engine = Engine::new();
|
||||
engine.set_strict_builtin_errors(strict);
|
||||
engine.set_gather_prints(true);
|
||||
|
||||
#[cfg(feature = "coverage")]
|
||||
engine.set_enable_coverage(true);
|
||||
@@ -206,7 +207,7 @@ pub fn eval_file(
|
||||
}
|
||||
}
|
||||
|
||||
Ok(results)
|
||||
Ok((results, engine.take_prints()?))
|
||||
}
|
||||
|
||||
#[derive(PartialEq, Debug)]
|
||||
@@ -254,6 +255,7 @@ struct TestCase {
|
||||
query: String,
|
||||
sort_bindings: Option<bool>,
|
||||
want_result: Option<ValueOrVec>,
|
||||
want_prints: Option<Vec<String>>,
|
||||
no_result: Option<bool>,
|
||||
skip: Option<bool>,
|
||||
error: Option<String>,
|
||||
@@ -333,7 +335,7 @@ fn yaml_test_impl(file: &str) -> Result<()> {
|
||||
enable_tracing,
|
||||
case.strict,
|
||||
) {
|
||||
Ok(results) => match case.want_result {
|
||||
Ok((results, prints)) => match case.want_result {
|
||||
Some(want_result) => {
|
||||
let mut expected_results = vec![];
|
||||
match want_result {
|
||||
@@ -344,6 +346,18 @@ fn yaml_test_impl(file: &str) -> Result<()> {
|
||||
}
|
||||
|
||||
check_output(&results, &expected_results)?;
|
||||
if let Some(expected_prints) = case.want_prints {
|
||||
assert_eq!(expected_prints.len(), prints.len());
|
||||
for (idx, ep) in expected_prints.into_iter().enumerate() {
|
||||
if ep != prints[idx] {
|
||||
std::println!(
|
||||
"print mismatch :\n{}",
|
||||
prettydiff::diff_chars(&ep, &prints[idx])
|
||||
);
|
||||
panic!("exiting");
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
_ if case.no_result == Some(true) => (),
|
||||
_ => bail!("eval succeeded and did not produce any errors"),
|
||||
|
||||
84
tests/interpreter/cases/builtins/debugging/print.yaml
Normal file
84
tests/interpreter/cases/builtins/debugging/print.yaml
Normal file
@@ -0,0 +1,84 @@
|
||||
# Copyright (c) Microsoft Corporation.
|
||||
# Licensed under the MIT License.
|
||||
|
||||
cases:
|
||||
- note: all
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
import rego.v1
|
||||
|
||||
x if {
|
||||
every obj in objs {
|
||||
print(obj)
|
||||
}
|
||||
|
||||
# Print twice
|
||||
[ 1 | [1, 2][_]; print(y) ]
|
||||
|
||||
# The following is printed only once due to early return, eventhough there is a loop.
|
||||
[1,2,3,4,5,6][_]
|
||||
|
||||
# Print multiple items
|
||||
# Note that if string is contained within another value, then quotes will be
|
||||
# printed around the string.
|
||||
print("Hello", ["Hello"], [{1:2}, {1,2}])
|
||||
|
||||
print("done")
|
||||
}
|
||||
|
||||
y if not z
|
||||
z := true
|
||||
|
||||
objs = [
|
||||
null,
|
||||
true,
|
||||
false,
|
||||
1,
|
||||
0,
|
||||
-0,
|
||||
-1,
|
||||
1.1,
|
||||
0.1,
|
||||
-1.1,
|
||||
"Hello",
|
||||
"hello\nworld",
|
||||
`hello
|
||||
world`,
|
||||
[1,2,3],
|
||||
{1,2,3},
|
||||
{"hello":"world",
|
||||
"வணக்கம்" : "ശുഭദിനം"},
|
||||
set(),
|
||||
{}
|
||||
]
|
||||
|
||||
query: data.test.x
|
||||
want_result: true
|
||||
want_prints:
|
||||
- "rego_0:6: null"
|
||||
- "rego_0:6: true"
|
||||
- "rego_0:6: false"
|
||||
- "rego_0:6: 1"
|
||||
- "rego_0:6: 0"
|
||||
- "rego_0:6: 0"
|
||||
- "rego_0:6: -1"
|
||||
- "rego_0:6: 1.1"
|
||||
- "rego_0:6: 0.1"
|
||||
- "rego_0:6: -1.1"
|
||||
- "rego_0:6: Hello"
|
||||
- "rego_0:6: hello\nworld"
|
||||
- "rego_0:6: hello\n world"
|
||||
- "rego_0:6: [1, 2, 3]"
|
||||
- "rego_0:6: {1, 2, 3}"
|
||||
- "rego_0:6: {\"hello\": \"world\", \"வணக்கம்\": \"ശുഭദിനം\"}"
|
||||
- "rego_0:6: {}"
|
||||
- "rego_0:6: {}"
|
||||
- "rego_0:10: <undefined>"
|
||||
- "rego_0:10: <undefined>"
|
||||
- "rego_0:18: Hello [\"Hello\"] [{1: 2}, {1, 2}]"
|
||||
- "rego_0:20: done"
|
||||
|
||||
|
||||
|
||||
1055
tests/kata/data/k8s-policy-job/prints.json
Normal file
1055
tests/kata/data/k8s-policy-job/prints.json
Normal file
File diff suppressed because it is too large
Load Diff
999
tests/kata/data/k8s-policy-pod/prints.json
Normal file
999
tests/kata/data/k8s-policy-pod/prints.json
Normal file
@@ -0,0 +1,999 @@
|
||||
[
|
||||
[],
|
||||
[],
|
||||
[],
|
||||
[
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1046: CreateSandboxRequest: i_pidns = false"
|
||||
],
|
||||
[],
|
||||
[
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:57: ======== CreateContainerRequest: trying next policy container",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:69: CreateContainerRequest: p Readonly = true i Readonly = true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:84: allow_anno 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:91: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-name\": \"policy-pod\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"nerdctl/network-namespace\": \"^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:92: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/kata-containers-k8s-tests_policy-pod_f7641c61-8a63-4bc6-98b9-6a4a5b0d860a\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"policy-pod\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"io.kubernetes.cri.sandbox-uid\": \"f7641c61-8a63-4bc6-98b9-6a4a5b0d860a\", \"nerdctl/network-namespace\": \"/var/run/netns/cni-3e413870-ed7b-d970-7440-cc55c7795613\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:95: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-type",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-type",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = nerdctl/network-namespace",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = nerdctl/network-namespace",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:101: allow_anno 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:123: allow_by_anno 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:137: allow_by_anno 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:143: allow_by_anno 2: i_s_name = policy-pod p_s_name = policy-pod",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:169: allow_sandbox_name 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:173: allow_sandbox_name 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:176: allow_sandbox_name 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:152: allow_by_sandbox_name: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:158: allow_by_sandbox_name: p_namespace = kata-containers-k8s-tests i_namespace = kata-containers-k8s-tests",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:190: allow_by_container_types: checking io.kubernetes.cri.container-type",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:196: allow_by_container_types: p_cri_type = sandbox i_cri_type = sandbox",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:205: allow_by_container_type 1: i_cri_type = sandbox",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:209: allow_by_container_type 1: i_kata_type = pod_sandbox",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:236: allow_sandbox_container_name: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:252: container_annotation_missing: io.kubernetes.cri.container-name",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:257: container_annotation_missing: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:240: allow_sandbox_container_name: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:274: allow_sandbox_net_namespace: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:280: allow_sandbox_net_namespace: p_namespace = ^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ i_namespace = /var/run/netns/cni-3e413870-ed7b-d970-7440-cc55c7795613",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:284: allow_sandbox_net_namespace: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:300: allow_sandbox_log_directory: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:307: allow_sandbox_log_directory: regex2 = ^/var/log/pods/kata-containers-k8s-tests_policy-pod_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:310: allow_sandbox_log_directory: i_dir = /var/log/pods/kata-containers-k8s-tests_policy-pod_f7641c61-8a63-4bc6-98b9-6a4a5b0d860a",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:314: allow_sandbox_log_directory: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:216: allow_by_container_type 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:220: allow_by_container_type 2: i_cri_type = sandbox",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:201: allow_by_container_types: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:430: allow_by_bundle_or_sandbox_id: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:440: allow_by_bundle_or_sandbox_id: sandbox_id = e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2 regex = ^[a-z0-9]{64}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:701: allow_root_path: i_path = /run/kata-containers/shared/containers/e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2/rootfs p_path1 = $(cpath)/$(bundle-id)/rootfs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:704: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)/rootfs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:707: allow_root_path: p_path3 = /run/kata-containers/shared/containers/e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2/rootfs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:711: allow_root_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = proc",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = proc",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = tmpfs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = tmpfs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = devpts",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = devpts",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = mqueue",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = mqueue",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = sysfs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = sysfs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"/run/kata-containers/shared/containers/e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2-c9c9b9dc84433468-resolv.conf\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2-[a-z0-9]{16}-resolv.conf$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:452: allow_by_bundle_or_sandbox_id: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:459: allow_process: i terminal = false p terminal = false",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:462: allow_process: i cwd = / i cwd = /",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:465: allow_process: i noNewPrivileges = true p noNewPrivileges = true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:982: allow_caps: policy Ambient = []",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:983: allow_caps: input Ambient = []",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1008: match_caps 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:986: allow_caps: policy Bounding = [\"$(default_caps)\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:987: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:990: allow_caps: policy Effective = [\"$(default_caps)\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:991: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:994: allow_caps: policy Inheritable = []",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:995: allow_caps: input Inheritable = []",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1008: match_caps 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:998: allow_caps: policy Permitted = [\"$(default_caps)\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:999: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:497: allow_args 1: no args",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:505: allow_args 2: policy args = [\"/pause\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:506: allow_args 2: input args = [\"/pause\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:518: allow_arg 1: i = 0 i_arg = /pause p_arg = /pause",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:523: allow_arg 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:527: allow_arg 2: i = 0 i_arg = /pause p_arg = /pause",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:536: allow_arg 3: i = 0 i_arg = /pause p_arg = /pause",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:540: allow_arg 3: p_arg3 = /pause",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:543: allow_arg 3: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:514: allow_args 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:548: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:549: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:563: allow_var 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:574: allow_var 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:556: allow_env: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:473: allow_process: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:165: allow_by_sandbox_name: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:148: allow_by_anno 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:330: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:333: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:345: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:348: allow_masked_paths 1: i_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/sys/devices/virtual/powercap\", \"/proc/scsi\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/acpi",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/asound",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/kcore",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/keys",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/latency_stats",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/timer_list",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/timer_stats",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/sched_debug",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /sys/firmware",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/scsi",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:352: allow_masked_paths 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:355: allow_masked_paths 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:382: allow_readonly_paths 1: p_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:385: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/bus",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/bus",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/fs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/fs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/irq",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/irq",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sys",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sys",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sysrq-trigger",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sysrq-trigger",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:389: allow_readonly_paths 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:392: allow_readonly_paths 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:340: allow_linux: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:79: CreateContainerRequest: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:57: ======== CreateContainerRequest: trying next policy container",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:69: CreateContainerRequest: p Readonly = false i Readonly = true"
|
||||
],
|
||||
[],
|
||||
[],
|
||||
[],
|
||||
[],
|
||||
[],
|
||||
[
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:57: ======== CreateContainerRequest: trying next policy container",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:69: CreateContainerRequest: p Readonly = true i Readonly = false",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:57: ======== CreateContainerRequest: trying next policy container",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:69: CreateContainerRequest: p Readonly = false i Readonly = false",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:84: allow_anno 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:91: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/prometheus/busybox:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"policy-pod\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:92: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/prometheus/busybox:latest\", \"io.kubernetes.cri.sandbox-id\": \"e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2\", \"io.kubernetes.cri.sandbox-name\": \"policy-pod\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"io.kubernetes.cri.sandbox-uid\": \"f7641c61-8a63-4bc6-98b9-6a4a5b0d860a\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:95: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-name",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-name",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-type",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-type",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.image-name",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.image-name",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:101: allow_anno 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:123: allow_by_anno 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:137: allow_by_anno 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:143: allow_by_anno 2: i_s_name = policy-pod p_s_name = policy-pod",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:169: allow_sandbox_name 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:173: allow_sandbox_name 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:176: allow_sandbox_name 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:152: allow_by_sandbox_name: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:158: allow_by_sandbox_name: p_namespace = kata-containers-k8s-tests i_namespace = kata-containers-k8s-tests",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:190: allow_by_container_types: checking io.kubernetes.cri.container-type",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:196: allow_by_container_types: p_cri_type = container i_cri_type = container",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:205: allow_by_container_type 1: i_cri_type = container",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:220: allow_by_container_type 2: i_cri_type = container",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:224: allow_by_container_type 2: i_kata_type = pod_container",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:244: allow_container_name: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:261: allow_container_annotation: key = io.kubernetes.cri.container-name",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:265: allow_container_annotation: p_value = busybox i_value = busybox",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:269: allow_container_annotation: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:248: allow_container_name: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:288: allow_net_namespace: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:295: allow_net_namespace: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:318: allow_log_directory: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:325: allow_log_directory: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:231: allow_by_container_type 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:201: allow_by_container_types: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:430: allow_by_bundle_or_sandbox_id: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:440: allow_by_bundle_or_sandbox_id: sandbox_id = e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2 regex = ^[a-z0-9]{64}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:701: allow_root_path: i_path = /run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9/rootfs p_path1 = $(cpath)/$(bundle-id)/rootfs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:704: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)/rootfs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:707: allow_root_path: p_path3 = /run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9/rootfs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:711: allow_root_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = proc",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = proc",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = tmpfs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = tmpfs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = devpts",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = devpts",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = mqueue",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = mqueue",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = sysfs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = sysfs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = cgroup",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = cgroup",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-b0241970194aa0f1-hosts\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-[a-z0-9]{16}-hosts$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-70afdd32aae261c9-termination-log\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-[a-z0-9]{16}-termination-log$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-cdfc9069abab6aa0-hostname\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-[a-z0-9]{16}-hostname$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-a9ad9599a85707b3-resolv.conf\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-[a-z0-9]{16}-resolv.conf$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-5f0e5e3718c35792-serviceaccount\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-[a-z0-9]{16}-serviceaccount$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:452: allow_by_bundle_or_sandbox_id: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:459: allow_process: i terminal = false p terminal = false",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:462: allow_process: i cwd = / i cwd = /",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:465: allow_process: i noNewPrivileges = false p noNewPrivileges = false",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:982: allow_caps: policy Ambient = []",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:983: allow_caps: input Ambient = []",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1008: match_caps 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:986: allow_caps: policy Bounding = [\"$(default_caps)\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:987: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:990: allow_caps: policy Effective = [\"$(default_caps)\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:991: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:994: allow_caps: policy Inheritable = []",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:995: allow_caps: input Inheritable = []",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1008: match_caps 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:998: allow_caps: policy Permitted = [\"$(default_caps)\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:999: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:497: allow_args 1: no args",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:505: allow_args 2: policy args = [\"sh\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:506: allow_args 2: input args = [\"sh\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:518: allow_arg 1: i = 0 i_arg = sh p_arg = sh",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:523: allow_arg 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:527: allow_arg 2: i = 0 i_arg = sh p_arg = sh",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:536: allow_arg 3: i = 0 i_arg = sh p_arg = sh",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:540: allow_arg 3: p_arg3 = sh",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:543: allow_arg 3: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:514: allow_args 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:548: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=$(host-name)\", \"KUBE_CONFIG_1=value-1\", \"KUBE_CONFIG_2=value-2\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:549: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=policy-pod\", \"KUBE_CONFIG_1=value-1\", \"KUBE_CONFIG_2=value-2\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:563: allow_var 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:574: allow_var 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = HOSTNAME=policy-pod",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:619: allow_var 5: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:563: allow_var 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:574: allow_var 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:563: allow_var 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:574: allow_var 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_PORT=443",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:556: allow_env: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:473: allow_process: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:165: allow_by_sandbox_name: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:148: allow_by_anno 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:330: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:333: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:345: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:348: allow_masked_paths 1: i_paths = [\"/proc/asound\", \"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/acpi",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/kcore",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/keys",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/latency_stats",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/timer_list",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/timer_stats",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/sched_debug",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/scsi",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /sys/firmware",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:352: allow_masked_paths 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:355: allow_masked_paths 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:382: allow_readonly_paths 1: p_paths = [\"/proc/asound\", \"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:385: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/asound",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/asound",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:424: allow_readonly_path 2: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/bus",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/bus",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/fs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/fs",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/irq",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/irq",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sys",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sys",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sysrq-trigger",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sysrq-trigger",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:389: allow_readonly_paths 1: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:392: allow_readonly_paths 2: start",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:340: allow_linux: true",
|
||||
"tests/kata/data/k8s-policy-pod/policy.rego:79: CreateContainerRequest: true"
|
||||
],
|
||||
[],
|
||||
[],
|
||||
[],
|
||||
[],
|
||||
[]
|
||||
]
|
||||
1000
tests/kata/data/k8s-policy-rc/prints.json
Normal file
1000
tests/kata/data/k8s-policy-rc/prints.json
Normal file
File diff suppressed because it is too large
Load Diff
1216
tests/kata/data/pod-cm1/prints.json
Normal file
1216
tests/kata/data/pod-cm1/prints.json
Normal file
File diff suppressed because it is too large
Load Diff
2400
tests/kata/data/pod-cm2/prints.json
Normal file
2400
tests/kata/data/pod-cm2/prints.json
Normal file
File diff suppressed because it is too large
Load Diff
1910
tests/kata/data/pod-exec/prints.json
Normal file
1910
tests/kata/data/pod-exec/prints.json
Normal file
File diff suppressed because it is too large
Load Diff
1582
tests/kata/data/pod-lifecycle/prints.json
Normal file
1582
tests/kata/data/pod-lifecycle/prints.json
Normal file
File diff suppressed because it is too large
Load Diff
8087
tests/kata/data/pod-many-layers/prints.json
Normal file
8087
tests/kata/data/pod-many-layers/prints.json
Normal file
File diff suppressed because one or more lines are too long
1509
tests/kata/data/pod-persistent-volumes/prints.json
Normal file
1509
tests/kata/data/pod-persistent-volumes/prints.json
Normal file
File diff suppressed because it is too large
Load Diff
3506
tests/kata/data/pod-same-containers/prints.json
Normal file
3506
tests/kata/data/pod-same-containers/prints.json
Normal file
File diff suppressed because it is too large
Load Diff
1631
tests/kata/data/web/prints.json
Normal file
1631
tests/kata/data/web/prints.json
Normal file
File diff suppressed because it is too large
Load Diff
1621
tests/kata/data/web2/prints.json
Normal file
1621
tests/kata/data/web2/prints.json
Normal file
File diff suppressed because it is too large
Load Diff
@@ -40,6 +40,7 @@ fn run_kata_tests(
|
||||
let policy_file = path.join("policy.rego");
|
||||
let inputs_file = path.join("inputs.txt");
|
||||
let outputs_file = path.join("outputs.json");
|
||||
let prints_file = path.join("prints.json");
|
||||
|
||||
let mut engine = Engine::new();
|
||||
engine.add_policy_from_file(&policy_file)?;
|
||||
@@ -62,6 +63,19 @@ fn run_kata_tests(
|
||||
.collect()
|
||||
};
|
||||
|
||||
let mut prints: Vec<Vec<String>> = if generate {
|
||||
vec![]
|
||||
} else {
|
||||
let prints_json = std::fs::read_to_string(&prints_file).map_err(|e| {
|
||||
anyhow::Error::msg(format!("could not read {}\n{e}", prints_file.display()))
|
||||
})?;
|
||||
|
||||
serde_json::from_str::<Vec<Vec<String>>>(&prints_json)?
|
||||
.into_iter()
|
||||
.rev()
|
||||
.collect()
|
||||
};
|
||||
|
||||
let inputs = std::fs::read_to_string(&inputs_file)?;
|
||||
for (lineno, line) in inputs.split('\n').enumerate() {
|
||||
let line = line.trim();
|
||||
@@ -96,9 +110,14 @@ fn run_kata_tests(
|
||||
|
||||
if generate {
|
||||
results.push(r);
|
||||
prints.push(engine.take_prints()?);
|
||||
} else {
|
||||
let expected = results.pop().unwrap();
|
||||
assert_eq!(r, expected, "{lineno} failed in {}", inputs_file.display());
|
||||
|
||||
let p = engine.take_prints()?;
|
||||
assert_eq!(p, new_engine.take_prints()?);
|
||||
assert_eq!(p, prints.pop().unwrap());
|
||||
}
|
||||
|
||||
num_queries += 2;
|
||||
@@ -106,6 +125,7 @@ fn run_kata_tests(
|
||||
|
||||
if generate {
|
||||
std::fs::write(outputs_file, Value::from(results).to_json_str()?)?;
|
||||
std::fs::write(prints_file, serde_json::to_string_pretty(&prints)?)?;
|
||||
}
|
||||
|
||||
if coverage {
|
||||
|
||||
Reference in New Issue
Block a user